./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1704889572 <...> Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. execve("./syz-executor1704889572", ["./syz-executor1704889572"], 0x7fff3150b790 /* 10 vars */) = 0 brk(NULL) = 0x555556d8d000 brk(0x555556d8dd40) = 0x555556d8dd40 arch_prctl(ARCH_SET_FS, 0x555556d8d3c0) = 0 set_tid_address(0x555556d8d690) = 293 set_robust_list(0x555556d8d6a0, 24) = 0 rseq(0x555556d8dce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1704889572", 4096) = 28 getrandom("\x9e\x64\x49\x73\x92\x7a\xc0\x2c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556d8dd40 brk(0x555556daed40) = 0x555556daed40 brk(0x555556daf000) = 0x555556daf000 mprotect(0x7f0c4a2d4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 294 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 295 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 296 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 297 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 298 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 299 ./strace-static-x86_64: Process 299 attached ./strace-static-x86_64: Process 294 attached [pid 299] set_robust_list(0x555556d8d6a0, 24 [pid 294] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 299] <... set_robust_list resumed>) = 0 [pid 294] mkdir("./syzkaller.iF59aB", 0700 [pid 299] mkdir("./syzkaller.o9q2AS", 0700 [pid 294] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 299] chmod("./syzkaller.o9q2AS", 0777) = 0 [pid 299] chdir("./syzkaller.o9q2AS") = 0 [pid 299] mkdir("./0", 0777) = 0 [pid 294] chmod("./syzkaller.iF59aB", 0777) = 0 [pid 294] chdir("./syzkaller.iF59aB") = 0 [pid 294] mkdir("./0", 0777./strace-static-x86_64: Process 295 attached [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR./strace-static-x86_64: Process 297 attached ./strace-static-x86_64: Process 298 attached ./strace-static-x86_64: Process 296 attached ) = 3 [pid 294] <... mkdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 300 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 301 ./strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 300] chdir("./0") = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3) = 0 [pid 300] symlink("/dev/binderfs", "./binderfs") = 0 [pid 300] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 300] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 301 attached [pid 298] set_robust_list(0x555556d8d6a0, 24 [pid 297] set_robust_list(0x555556d8d6a0, 24 [pid 296] set_robust_list(0x555556d8d6a0, 24 [pid 295] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 295] mkdir("./syzkaller.jAi0v3", 0700 [pid 297] <... set_robust_list resumed>) = 0 [pid 297] mkdir("./syzkaller.yAZgI2", 0700 [pid 298] <... set_robust_list resumed>) = 0 [pid 298] mkdir("./syzkaller.qPQybd", 0700 [pid 296] <... set_robust_list resumed>) = 0 [pid 301] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 300] <... clone3 resumed> => {parent_tid=[304]}, 88) = 304 [pid 301] chdir("./0") = 0 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 304 attached [pid 301] <... prctl resumed>) = 0 [pid 304] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 301] setpgid(0, 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], [pid 301] <... setpgid resumed>) = 0 [pid 304] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 304] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 301] write(3, "1000", 4) = 4 [pid 301] close(3) = 0 [pid 301] symlink("/dev/binderfs", "./binderfs" [pid 300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [pid 301] <... symlink resumed>) = 0 [pid 304] memfd_create("syzkaller", 0 [pid 301] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... memfd_create resumed>) = 3 [pid 301] <... futex resumed>) = 0 [pid 304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 301] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 304] <... mmap resumed>) = 0x7f0c41dee000 [pid 301] <... rt_sigaction resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] mkdir("./syzkaller.rVgsXW", 0700 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 300] <... mmap resumed>) = 0x7f0c41dcd000 [pid 304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 300] <... mprotect resumed>) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] chmod("./syzkaller.qPQybd", 0777 [pid 297] chmod("./syzkaller.yAZgI2", 0777 [pid 296] chmod("./syzkaller.rVgsXW", 0777 [pid 295] chmod("./syzkaller.jAi0v3", 0777 [pid 304] <... write resumed>) = 262144 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... chmod resumed>) = 0 [pid 297] <... chmod resumed>) = 0 [pid 296] <... chmod resumed>) = 0 [pid 295] <... chmod resumed>) = 0 [pid 304] munmap(0x7f0c41dee000, 138412032 [pid 301] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 304] <... munmap resumed>) = 0 [pid 301] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 304] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 301] <... mprotect resumed>) = 0 [pid 304] <... openat resumed>) = 4 [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 298] chdir("./syzkaller.qPQybd" [pid 297] chdir("./syzkaller.yAZgI2" [pid 296] chdir("./syzkaller.rVgsXW" [pid 295] chdir("./syzkaller.jAi0v3" [pid 298] <... chdir resumed>) = 0 [pid 297] <... chdir resumed>) = 0 [pid 296] <... chdir resumed>) = 0 [pid 295] <... chdir resumed>) = 0 [pid 300] <... clone3 resumed> => {parent_tid=[305]}, 88) = 305 [pid 298] mkdir("./0", 0777 [pid 297] mkdir("./0", 0777 [pid 296] mkdir("./0", 0777 [pid 295] mkdir("./0", 0777 [pid 300] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 296] close(3 [pid 295] close(3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 307 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 308 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 309 [ 22.169006][ T30] audit: type=1400 audit(1703527012.396:66): avc: denied { execmem } for pid=293 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.176030][ T30] audit: type=1400 audit(1703527012.396:67): avc: denied { read write } for pid=299 comm="syz-executor170" name="loop5" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.183793][ T30] audit: type=1400 audit(1703527012.396:68): avc: denied { open } for pid=299 comm="syz-executor170" path="/dev/loop5" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 310 ./strace-static-x86_64: Process 309 attached [pid 309] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 309] chdir("./0") = 0 [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setpgid(0, 0) = 0 [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "1000", 4) = 4 [pid 309] close(3) = 0 [pid 309] symlink("/dev/binderfs", "./binderfs") = 0 [pid 309] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] ioctl(4, LOOP_SET_FD, 3 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 310 attached ./strace-static-x86_64: Process 308 attached ./strace-static-x86_64: Process 307 attached ./strace-static-x86_64: Process 305 attached [pid 309] <... futex resumed>) = 0 [pid 304] <... ioctl resumed>) = 0 [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 310] set_robust_list(0x555556d8d6a0, 24 [pid 309] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 308] set_robust_list(0x555556d8d6a0, 24 [pid 307] set_robust_list(0x555556d8d6a0, 24 [pid 305] set_robust_list(0x7f0c41ded9a0, 24 [pid 304] close(3 [pid 310] <... set_robust_list resumed>) = 0 [pid 309] <... rt_sigaction resumed>NULL, 8) = 0 [pid 308] <... set_robust_list resumed>) = 0 [pid 307] <... set_robust_list resumed>) = 0 [pid 305] <... set_robust_list resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 301] <... clone3 resumed> => {parent_tid=[311]}, 88) = 311 [pid 310] chdir("./0" [pid 309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 308] chdir("./0" [pid 307] chdir("./0" [pid 305] rt_sigprocmask(SIG_SETMASK, [], [pid 304] mkdir("./file1", 0777 [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... chdir resumed>) = 0 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... chdir resumed>) = 0 [pid 307] <... chdir resumed>) = 0 [pid 305] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 305] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 304] <... mkdir resumed>) = 0 [pid 301] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... prctl resumed>) = 0 [pid 309] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 308] <... prctl resumed>) = 0 [pid 307] <... prctl resumed>) = 0 [pid 305] <... open resumed>) = 3 [pid 304] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 301] <... futex resumed>) = 0 ./strace-static-x86_64: Process 311 attached [pid 310] setpgid(0, 0 [pid 309] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 308] setpgid(0, 0 [pid 307] setpgid(0, 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] set_robust_list(0x7f0c4a20e9a0, 24 [pid 309] <... mprotect resumed>) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... set_robust_list resumed>) = 0 [pid 310] <... setpgid resumed>) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] <... setpgid resumed>) = 0 [pid 307] <... setpgid resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 301] <... futex resumed>) = 0 [pid 300] <... futex resumed>) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], [pid 309] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 300] <... futex resumed>) = 0 [pid 311] memfd_create("syzkaller", 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... memfd_create resumed>) = 3 [pid 309] <... clone3 resumed> => {parent_tid=[312]}, 88) = 312 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [], [pid 311] <... mmap resumed>) = 0x7f0c41dee000 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 309] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... write resumed>) = 262144 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 309] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 311] munmap(0x7f0c41dee000, 138412032 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 311] <... munmap resumed>) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 309] <... clone3 resumed> => {parent_tid=[313]}, 88) = 313 ./strace-static-x86_64: Process 312 attached [pid 311] <... openat resumed>) = 4 [pid 309] rt_sigprocmask(SIG_SETMASK, [], [pid 312] set_robust_list(0x7f0c4a20e9a0, 24 [pid 311] ioctl(4, LOOP_SET_FD, 3 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 22.204973][ T30] audit: type=1400 audit(1703527012.396:69): avc: denied { ioctl } for pid=294 comm="syz-executor170" path="/dev/loop0" dev="devtmpfs" ino=112 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.231107][ T304] loop5: detected capacity change from 0 to 512 [ 22.244355][ T30] audit: type=1400 audit(1703527012.466:70): avc: denied { mounton } for pid=300 comm="syz-executor170" path="/root/syzkaller.o9q2AS/0/bus" dev="sda1" ino=1943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=file permissive=1 [pid 312] <... set_robust_list resumed>) = 0 [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 305] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... openat resumed>) = 3 [pid 309] <... futex resumed>) = 0 [pid 308] <... openat resumed>) = 3 [pid 307] <... openat resumed>) = 3 [pid 305] <... mount resumed>) = 0 [pid 301] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] write(3, "1000", 4 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] write(3, "1000", 4 [pid 307] write(3, "1000", 4 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 313 attached [pid 312] memfd_create("syzkaller", 0 [pid 310] <... write resumed>) = 4 [pid 308] <... write resumed>) = 4 [pid 307] <... write resumed>) = 4 [pid 305] <... futex resumed>) = 1 [pid 301] <... mprotect resumed>) = 0 [pid 300] <... futex resumed>) = 0 [pid 313] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 312] <... memfd_create resumed>) = 3 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... set_robust_list resumed>) = 0 [pid 312] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... futex resumed>) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], [pid 312] <... mmap resumed>) = 0x7f0c41dcd000 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 312] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 310] close(3 [pid 308] close(3 [pid 307] close(3 [pid 305] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 313] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 312] <... write resumed>) = 262144 [pid 310] <... close resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 307] <... close resumed>) = 0 [pid 305] <... open resumed>) = 5 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 313] <... open resumed>) = 4 [pid 312] munmap(0x7f0c41dcd000, 138412032 [pid 310] symlink("/dev/binderfs", "./binderfs" [pid 308] symlink("/dev/binderfs", "./binderfs" [pid 307] symlink("/dev/binderfs", "./binderfs" [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... munmap resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 310] <... symlink resumed>) = 0 [pid 308] <... symlink resumed>) = 0 [pid 307] <... symlink resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 300] <... futex resumed>) = 0 [pid 311] close(3 [pid 310] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... clone3 resumed> => {parent_tid=[317]}, 88) = 317 [pid 311] <... close resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 311] mkdir("./file1", 0777 [pid 310] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 308] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 307] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 310] <... rt_sigaction resumed>NULL, 8) = 0 [pid 308] <... rt_sigaction resumed>NULL, 8) = 0 [pid 307] <... rt_sigaction resumed>NULL, 8) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [ 22.255856][ T311] loop0: detected capacity change from 0 to 512 [ 22.286993][ T304] EXT4-fs (loop5): 1 orphan inode deleted [ 22.289618][ T30] audit: type=1400 audit(1703527012.516:71): avc: denied { mounton } for pid=301 comm="syz-executor170" path="/root/syzkaller.iF59aB/0/file1" dev="sda1" ino=1948 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 310] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 307] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 301] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 309] <... futex resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 308] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 307] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 310] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 308] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 310] <... mprotect resumed>) = 0 [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 310] <... clone3 resumed> => {parent_tid=[318]}, 88) = 318 [pid 308] <... clone3 resumed> => {parent_tid=[319]}, 88) = 319 [pid 307] <... clone3 resumed> => {parent_tid=[320]}, 88) = 320 [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 308] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 307] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 310] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 308] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 310] <... mprotect resumed>) = 0 [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 310] <... clone3 resumed> => {parent_tid=[321]}, 88) = 321 [pid 308] <... clone3 resumed> => {parent_tid=[322]}, 88) = 322 [pid 307] <... clone3 resumed> => {parent_tid=[323]}, 88) = 323 [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 1 [pid 305] <... futex resumed>) = 0 [pid 313] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 305] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... write resumed>) = 8 ./strace-static-x86_64: Process 318 attached [pid 313] <... mount resumed>) = 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... futex resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 318] set_robust_list(0x7f0c4a20e9a0, 24 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 318] <... set_robust_list resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] rt_sigprocmask(SIG_SETMASK, [], [pid 313] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 305] <... write resumed>) = 1045 [pid 318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... open resumed>) = 6 [pid 318] memfd_create("syzkaller", 0) = 3 [pid 305] <... futex resumed>) = 1 [pid 300] <... futex resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] <... openat resumed>) = 5 [pid 313] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] ioctl(5, LOOP_SET_FD, 3 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 318] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 318] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 318] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 323 attached ./strace-static-x86_64: Process 322 attached ./strace-static-x86_64: Process 321 attached ./strace-static-x86_64: Process 320 attached ./strace-static-x86_64: Process 319 attached [pid 317] <... write resumed>) = 8 [pid 313] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 318] <... ioctl resumed>) = 0 [pid 318] close(3) = 0 [pid 318] mkdir("./file1", 0777) = 0 [ 22.293125][ T304] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.333454][ T312] loop2: detected capacity change from 0 to 512 [ 22.336947][ T318] loop1: detected capacity change from 0 to 512 [ 22.342396][ T311] EXT4-fs (loop0): 1 orphan inode deleted [pid 318] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 313] <... write resumed>) = -1 EIO (Input/output error) [pid 310] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 301] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] <... futex resumed>) = 0 [pid 308] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 308] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 307] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 301] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 310] <... mprotect resumed>) = 0 [pid 308] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 301] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 301] <... mprotect resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 308] <... clone3 resumed> => {parent_tid=[329]}, 88) = 329 [pid 307] <... clone3 resumed> => {parent_tid=[328]}, 88) = 328 [pid 301] <... clone3 resumed> => {parent_tid=[330]}, 88) = 330 [pid 310] <... clone3 resumed> => {parent_tid=[327]}, 88) = 327 [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 308] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 322] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 321] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 320] set_robust_list(0x7f0c4a20e9a0, 24 [pid 319] set_robust_list(0x7f0c4a20e9a0, 24 [pid 322] <... set_robust_list resumed>) = 0 [pid 321] <... set_robust_list resumed>) = 0 [pid 320] <... set_robust_list resumed>) = 0 [pid 323] <... set_robust_list resumed>) = 0 [pid 319] <... set_robust_list resumed>) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [], [pid 321] rt_sigprocmask(SIG_SETMASK, [], [pid 320] rt_sigprocmask(SIG_SETMASK, [], [pid 323] rt_sigprocmask(SIG_SETMASK, [], [pid 319] rt_sigprocmask(SIG_SETMASK, [], [pid 322] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 320] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 323] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 321] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 322] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 320] memfd_create("syzkaller", 0 [pid 323] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 322] <... open resumed>) = 3 [pid 321] <... open resumed>) = 3 [pid 319] memfd_create("syzkaller", 0 [pid 323] <... open resumed>) = 3 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] <... memfd_create resumed>) = 4 [pid 319] <... memfd_create resumed>) = 4 [pid 312] <... ioctl resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 313] <... futex resumed>) = 0 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = 0 [pid 321] <... futex resumed>) = 0 [pid 320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 312] close(3 [pid 323] <... futex resumed>) = 0 [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... mmap resumed>) = 0x7f0c41dac000 [pid 319] <... mmap resumed>) = 0x7f0c41dac000 [pid 313] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... close resumed>) = 0 [pid 320] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 319] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [ 22.348074][ T30] audit: type=1400 audit(1703527012.576:72): avc: denied { mount } for pid=300 comm="syz-executor170" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.351626][ T54] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 22.384098][ T304] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.401543][ T318] EXT4-fs (loop1): 1 orphan inode deleted [ 22.403377][ T320] loop4: detected capacity change from 0 to 512 [pid 312] mkdir("./bus", 0777 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 330 attached ./strace-static-x86_64: Process 329 attached ./strace-static-x86_64: Process 328 attached ./strace-static-x86_64: Process 327 attached [pid 320] <... write resumed>) = 262144 [pid 319] <... write resumed>) = 262144 [pid 312] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 320] munmap(0x7f0c41dac000, 138412032) = 0 [pid 319] munmap(0x7f0c41dac000, 138412032 [pid 320] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 319] <... munmap resumed>) = 0 [pid 320] <... openat resumed>) = 5 [pid 319] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 320] ioctl(5, LOOP_SET_FD, 4 [pid 319] <... openat resumed>) = 5 [pid 319] ioctl(5, LOOP_SET_FD, 4 [pid 330] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 329] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 328] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 327] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 312] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 301] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = 0 [pid 322] <... futex resumed>) = 0 [pid 321] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 1 [pid 307] <... futex resumed>) = 1 [pid 323] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 322] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 321] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... open resumed>) = 6 [pid 322] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 321] <... open resumed>) = 5 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = 1 [pid 322] <... futex resumed>) = 1 [pid 321] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 323] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 322] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 321] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 330] <... set_robust_list resumed>) = 0 [pid 329] <... set_robust_list resumed>) = 0 [pid 328] <... set_robust_list resumed>) = 0 [pid 327] <... set_robust_list resumed>) = 0 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] rt_sigprocmask(SIG_SETMASK, [], [pid 329] rt_sigprocmask(SIG_SETMASK, [], [pid 328] rt_sigprocmask(SIG_SETMASK, [], [pid 327] rt_sigprocmask(SIG_SETMASK, [], [pid 322] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 0 [pid 330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 327] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 22.407106][ T318] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.407192][ T318] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.413523][ T319] loop3: detected capacity change from 0 to 512 [ 22.435435][ T311] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.435537][ T311] ext4 filesystem being mounted at /root/syzkaller.iF59aB/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 323] <... write resumed>) = 8 [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] <... write resumed>) = 8 [pid 320] <... ioctl resumed>) = 0 [pid 319] <... ioctl resumed>) = 0 [pid 318] <... mount resumed>) = 0 [pid 311] <... mount resumed>) = 0 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 329] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 328] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 327] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] close(4 [pid 319] close(4 [pid 318] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 311] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 329] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 328] <... mount resumed>) = 0 [pid 323] <... futex resumed>) = 1 [pid 321] <... futex resumed>) = 1 [pid 320] <... close resumed>) = 0 [pid 322] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 319] <... close resumed>) = 0 [pid 318] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 311] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 327] <... mount resumed>) = 0 [pid 304] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 330] <... write resumed>) = 1045 [pid 329] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] mkdir("./bus", 0777 [pid 319] mkdir("./file1", 0777 [pid 318] ioctl(4, LOOP_CLR_FD [pid 311] ioctl(4, LOOP_CLR_FD [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] ioctl(4, LOOP_CLR_FD [pid 330] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 329] <... futex resumed>) = 0 [pid 328] <... futex resumed>) = 0 [pid 327] <... futex resumed>) = 0 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 320] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 319] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 318] <... ioctl resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 304] <... ioctl resumed>) = 0 [pid 330] <... futex resumed>) = 0 [pid 329] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 328] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 327] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 322] <... futex resumed>) = 0 [pid 321] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 320] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 319] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 318] close(4 [pid 311] close(4 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 307] <... futex resumed>) = 0 [pid 304] close(4 [pid 330] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] <... close resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 318] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = 0 [pid 304] <... futex resumed>) = 0 [pid 318] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... write resumed>) = 1045 [pid 321] <... write resumed>) = 1045 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] exit_group(0 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] exit_group(0 [pid 323] <... futex resumed>) = 0 [pid 300] <... exit_group resumed>) = ? [pid 321] <... futex resumed>) = 0 [pid 310] exit_group(0 [pid 330] <... futex resumed>) = ? [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 317] <... futex resumed>) = ? [pid 310] <... exit_group resumed>) = ? [pid 327] <... futex resumed>) = ? [pid 301] <... exit_group resumed>) = ? [pid 330] +++ exited with 0 +++ [pid 327] +++ exited with 0 +++ [pid 318] <... futex resumed>) = ? [pid 317] +++ exited with 0 +++ [pid 311] <... futex resumed>) = ? [pid 305] <... futex resumed>) = ? [pid 304] <... futex resumed>) = ? [pid 321] +++ exited with 0 +++ [pid 318] +++ exited with 0 +++ [pid 311] +++ exited with 0 +++ [pid 310] +++ exited with 0 +++ [pid 305] +++ exited with 0 +++ [pid 301] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=310, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=301, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [ 22.464231][ T30] audit: type=1400 audit(1703527012.686:73): avc: denied { mounton } for pid=309 comm="syz-executor170" path="/root/syzkaller.rVgsXW/0/bus" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.496443][ T312] EXT4-fs (loop2): 1 orphan inode deleted [ 22.503410][ T312] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 22.522938][ T320] EXT4-fs (loop4): 1 orphan inode deleted [ 22.526341][ T312] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.530731][ T319] EXT4-fs (loop3): 1 orphan inode deleted [ 22.540712][ T320] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.546280][ T319] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 294] newfstatat(3, "", [pid 312] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 295] newfstatat(3, "", [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 312] ioctl(5, LOOP_CLR_FD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, [pid 312] <... ioctl resumed>) = 0 [pid 295] getdents64(3, [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 312] close(5 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 312] <... close resumed>) = 0 [pid 304] +++ exited with 0 +++ [pid 300] +++ exited with 0 +++ [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./0/bus", [pid 294] newfstatat(AT_FDCWD, "./0/bus", [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./0/bus" [pid 294] unlink("./0/bus" [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 295] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=300, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] newfstatat(AT_FDCWD, "./0/binderfs", [pid 294] newfstatat(AT_FDCWD, "./0/binderfs", [pid 312] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 312] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] exit_group(0 [pid 295] unlink("./0/binderfs" [pid 294] unlink("./0/binderfs" [pid 313] <... futex resumed>) = ? [pid 309] <... exit_group resumed>) = ? [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 313] +++ exited with 0 +++ [pid 312] <... futex resumed>) = ? [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 22.567130][ T320] ext4 filesystem being mounted at /root/syzkaller.qPQybd/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.567507][ T319] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.582864][ T30] audit: type=1400 audit(1703527012.806:74): avc: denied { unmount } for pid=294 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [pid 299] unlink("./0/bus") = 0 [pid 299] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./0/binderfs") = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./0/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./0") = 0 [pid 299] mkdir("./1", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 340 ./strace-static-x86_64: Process 340 attached [pid 340] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 340] chdir("./1") = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 319] ioctl(5, LOOP_CLR_FD [pid 320] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 340] <... futex resumed>) = 0 [pid 340] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 340] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 320] ioctl(5, LOOP_CLR_FD [pid 340] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 340] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 341 attached => {parent_tid=[341]}, 88) = 341 [pid 341] set_robust_list(0x7f0c4a20e9a0, 24 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... set_robust_list resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 340] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 341] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 340] <... mprotect resumed>) = 0 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 341] memfd_create("syzkaller", 0) = 3 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0}./strace-static-x86_64: Process 342 attached [pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 340] <... clone3 resumed> => {parent_tid=[342]}, 88) = 342 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], [pid 341] <... mmap resumed>) = 0x7f0c41dcd000 [pid 342] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 342] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 342] <... futex resumed>) = 1 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 340] <... futex resumed>) = 0 [pid 342] <... open resumed>) = 5 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 340] <... futex resumed>) = 0 [pid 342] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] <... write resumed>) = 262144 [pid 341] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 341] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 6 [pid 341] ioctl(6, LOOP_SET_FD, 3 [pid 312] +++ exited with 0 +++ [pid 309] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=309, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./0/file1", [pid 341] <... ioctl resumed>) = 0 [pid 341] close(3) = 0 [pid 341] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 341] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... restart_syscall resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./0/file1", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] newfstatat(3, "", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... openat resumed>) = 4 [pid 295] <... openat resumed>) = 4 [pid 296] getdents64(3, [pid 295] newfstatat(4, "", [pid 294] newfstatat(4, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 296] <... umount2 resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] newfstatat(AT_FDCWD, "./0/bus", [pid 295] close(4 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... close resumed>) = 0 [pid 294] close(4 [pid 296] unlink("./0/bus" [pid 295] rmdir("./0/file1" [pid 296] <... unlink resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 296] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 294] rmdir("./0/file1" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./0" [pid 296] newfstatat(AT_FDCWD, "./0/binderfs", [pid 294] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] getdents64(3, [pid 296] unlink("./0/binderfs" [pid 295] mkdir("./1", 0777 [pid 296] <... unlink resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 295] close(3 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 296] rmdir("./0" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... rmdir resumed>) = 0 [pid 294] close(3 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 343 [pid 296] mkdir("./1", 0777 [pid 294] <... close resumed>) = 0 ./strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x555556d8d6a0, 24 [pid 320] <... ioctl resumed>) = 0 [pid 343] <... set_robust_list resumed>) = 0 [pid 319] <... ioctl resumed>) = 0 [pid 319] close(5 [pid 320] close(5) = 0 [pid 319] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [ 22.620857][ T30] audit: type=1400 audit(1703527012.846:75): avc: denied { unmount } for pid=295 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.660890][ T341] loop5: detected capacity change from 0 to 512 [pid 294] rmdir("./0" [pid 320] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] <... rmdir resumed>) = 0 [pid 320] <... futex resumed>) = 0 [pid 319] <... futex resumed>) = 0 [pid 320] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 319] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] mkdir("./1", 0777 [pid 296] <... openat resumed>) = 3 [pid 308] exit_group(0 [pid 307] exit_group(0 [pid 328] <... futex resumed>) = ? [pid 308] <... exit_group resumed>) = ? [pid 307] <... exit_group resumed>) = ? [pid 329] <... futex resumed>) = ? [pid 322] <... futex resumed>) = ? [pid 328] +++ exited with 0 +++ [pid 323] <... futex resumed>) = ? [pid 329] +++ exited with 0 +++ [pid 323] +++ exited with 0 +++ [pid 322] +++ exited with 0 +++ [pid 294] <... mkdir resumed>) = 0 [pid 319] <... futex resumed>) = 0 [pid 320] <... futex resumed>) = ? [pid 296] ioctl(3, LOOP_CLR_FD [pid 343] chdir("./1" [pid 319] +++ exited with 0 +++ [pid 308] +++ exited with 0 +++ [pid 343] <... chdir resumed>) = 0 [pid 320] +++ exited with 0 +++ [pid 307] +++ exited with 0 +++ [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=307, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=308, si_uid=0, si_status=0, si_utime=0, si_stime=10} --- [pid 296] close(3 [pid 294] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 297] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] ioctl(3, LOOP_CLR_FD [pid 298] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 346 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 3 [pid 294] close(3 [pid 298] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 298] getdents64(3, [pid 343] <... prctl resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 347 [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./0/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./0/bus", [pid 297] unlink("./0/binderfs" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 298] unlink("./0/bus" [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1", [pid 298] newfstatat(AT_FDCWD, "./0/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1" [pid 298] unlink("./0/binderfs" [pid 297] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] getdents64(3, [pid 298] getdents64(3, [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 347 attached [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3./strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./0" [pid 298] rmdir("./0" [pid 346] chdir("./1") = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0 [pid 297] <... rmdir resumed>) = 0 [pid 346] <... setpgid resumed>) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... rmdir resumed>) = 0 [pid 297] mkdir("./1", 0777 [pid 298] mkdir("./1", 0777 [pid 346] <... openat resumed>) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 297] <... mkdir resumed>) = 0 [pid 346] close(3) = 0 [pid 346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 297] close(3 [pid 346] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 346] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 346] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 346] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 346] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 348 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 349 [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[350]}, 88) = 350 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] set_robust_list(0x555556d8d6a0, 24 [pid 346] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 343] setpgid(0, 0 [pid 346] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 348 attached ) = 0 [pid 348] set_robust_list(0x555556d8d6a0, 24 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [pid 348] <... set_robust_list resumed>) = 0 [pid 346] <... rt_sigprocmask resumed>[], 8) = 0 [pid 348] chdir("./1" [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 348] <... chdir resumed>) = 0 [pid 348] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 346] <... clone3 resumed> => {parent_tid=[351]}, 88) = 351 [pid 348] <... prctl resumed>) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [], [pid 348] setpgid(0, 0 [pid 346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 348] <... setpgid resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 346] <... futex resumed>) = 0 [pid 348] <... openat resumed>) = 3 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... set_robust_list resumed>) = 0 [pid 348] write(3, "1000", 4 [pid 343] <... setpgid resumed>) = 0 [pid 348] <... write resumed>) = 4 [pid 348] close(3) = 0 [pid 348] symlink("/dev/binderfs", "./binderfs" [pid 347] chdir("./1" [pid 348] <... symlink resumed>) = 0 [pid 347] <... chdir resumed>) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 348] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 348] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 348] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[352]}, 88) = 352 [pid 348] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 348] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[353]}, 88) = 353 [pid 348] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 349] chdir("./1") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 349] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 349] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[354]}, 88) = 354 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 349] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[355]}, 88) = 355 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 354] memfd_create("syzkaller", 0) = 3 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 354] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 343] <... openat resumed>) = 3 [pid 347] <... prctl resumed>) = 0 [pid 354] <... write resumed>) = 262144 [ 22.683193][ T341] EXT4-fs (loop5): 1 orphan inode deleted [ 22.706813][ T341] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.720398][ T354] loop3: detected capacity change from 0 to 512 [pid 354] munmap(0x7f0c41dcd000, 138412032 [pid 347] setpgid(0, 0 [pid 343] write(3, "1000", 4 [pid 347] <... setpgid resumed>) = 0 [pid 354] <... munmap resumed>) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_SET_FD, 3 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 343] <... write resumed>) = 4 [pid 354] <... ioctl resumed>) = 0 [pid 354] close(3) = 0 [pid 354] mkdir("./file1", 0777) = 0 [pid 354] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 351 attached ./strace-static-x86_64: Process 350 attached [pid 347] <... openat resumed>) = 3 [pid 347] write(3, "1000", 4 [pid 343] close(3 [pid 347] <... write resumed>) = 4 [pid 343] <... close resumed>) = 0 [pid 347] close(3) = 0 [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 343] <... futex resumed>) = 0 [pid 347] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 343] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 343] <... rt_sigaction resumed>NULL, 8) = 0 [pid 347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 343] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 343] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 347] <... mprotect resumed>) = 0 [pid 343] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[357]}, 88) = 357 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] <... clone3 resumed> => {parent_tid=[356]}, 88) = 356 [pid 347] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] rt_sigprocmask(SIG_SETMASK, [], [pid 347] <... futex resumed>) = 0 [pid 343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 343] <... futex resumed>) = 0 [pid 347] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 343] <... futex resumed>) = 0 [pid 347] <... mprotect resumed>) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 343] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 343] <... mprotect resumed>) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 347] <... clone3 resumed> => {parent_tid=[358]}, 88) = 358 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 350] set_robust_list(0x7f0c4a20e9a0, 24./strace-static-x86_64: Process 352 attached ./strace-static-x86_64: Process 353 attached ./strace-static-x86_64: Process 355 attached [pid 351] <... set_robust_list resumed>) = 0 [pid 350] <... set_robust_list resumed>) = 0 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... clone3 resumed> => {parent_tid=[359]}, 88) = 359 ./strace-static-x86_64: Process 359 attached ./strace-static-x86_64: Process 358 attached ./strace-static-x86_64: Process 357 attached ./strace-static-x86_64: Process 356 attached [pid 352] set_robust_list(0x7f0c4a20e9a0, 24 [pid 351] rt_sigprocmask(SIG_SETMASK, [], [pid 350] rt_sigprocmask(SIG_SETMASK, [], [pid 352] <... set_robust_list resumed>) = 0 [pid 351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 347] <... futex resumed>) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], [pid 352] rt_sigprocmask(SIG_SETMASK, [], [pid 351] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 350] memfd_create("syzkaller", 0 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 353] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 352] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] <... open resumed>) = 3 [pid 350] <... memfd_create resumed>) = 4 [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... set_robust_list resumed>) = 0 [pid 352] memfd_create("syzkaller", 0 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 343] <... futex resumed>) = 0 [pid 352] <... memfd_create resumed>) = 3 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 350] <... mmap resumed>) = 0x7f0c41dcd000 [pid 358] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 357] set_robust_list(0x7f0c4a20e9a0, 24 [pid 356] set_robust_list(0x7f0c4a20e9a0, 24 [pid 355] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 353] rt_sigprocmask(SIG_SETMASK, [], [pid 352] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 351] <... futex resumed>) = 1 [pid 346] <... futex resumed>) = 0 [pid 341] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 350] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 352] <... mmap resumed>) = 0x7f0c41dcd000 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... set_robust_list resumed>) = 0 [pid 356] <... set_robust_list resumed>) = 0 [pid 355] <... set_robust_list resumed>) = 0 [pid 353] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 341] ioctl(6, LOOP_CLR_FD [pid 350] <... write resumed>) = 262144 [pid 346] <... futex resumed>) = 0 [pid 352] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 358] <... set_robust_list resumed>) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], [pid 356] rt_sigprocmask(SIG_SETMASK, [], [pid 355] rt_sigprocmask(SIG_SETMASK, [], [pid 353] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 351] <... mount resumed>) = 0 [pid 350] munmap(0x7f0c41dcd000, 138412032 [pid 341] <... ioctl resumed>) = 0 [pid 353] <... open resumed>) = 4 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] close(6 [pid 352] <... write resumed>) = 262144 [pid 351] <... futex resumed>) = 1 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 341] <... close resumed>) = 0 [pid 358] rt_sigprocmask(SIG_SETMASK, [], [pid 357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 355] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 353] <... futex resumed>) = 1 [pid 352] munmap(0x7f0c41dcd000, 138412032 [pid 351] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 350] <... munmap resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] memfd_create("syzkaller", 0 [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 351] <... open resumed>) = 5 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] exit_group(0 [pid 359] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 358] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 357] memfd_create("syzkaller", 0 [pid 356] <... memfd_create resumed>) = 3 [pid 355] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] <... munmap resumed>) = 0 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] <... exit_group resumed>) = ? [pid 342] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 359] <... set_robust_list resumed>) = 0 [pid 358] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 357] <... memfd_create resumed>) = 3 [pid 356] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 355] <... open resumed>) = 3 [pid 353] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 352] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 351] <... futex resumed>) = 0 [pid 350] <... openat resumed>) = 6 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... mount resumed>) = 0 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 342] +++ exited with 0 +++ [pid 359] rt_sigprocmask(SIG_SETMASK, [], [pid 358] <... open resumed>) = 4 [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 356] <... mmap resumed>) = 0x7f0c41dcd000 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... openat resumed>) = 5 [pid 350] ioctl(6, LOOP_SET_FD, 4 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... mmap resumed>) = 0x7f0c41dcd000 [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 352] ioctl(5, LOOP_SET_FD, 3 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 356] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 355] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 353] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 352] <... ioctl resumed>) = 0 [pid 351] <... futex resumed>) = 0 [pid 350] <... ioctl resumed>) = 0 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 1 [pid 357] <... write resumed>) = 262144 [pid 356] <... write resumed>) = 262144 [pid 355] <... mount resumed>) = 0 [pid 353] <... open resumed>) = 6 [pid 352] close(3 [pid 351] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] munmap(0x7f0c41dcd000, 138412032 [pid 356] munmap(0x7f0c41dcd000, 138412032 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... close resumed>) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... munmap resumed>) = 0 [pid 356] <... munmap resumed>) = 0 [pid 355] <... futex resumed>) = 0 [pid 353] <... futex resumed>) = 0 [pid 352] mkdir("./bus", 0777 [pid 349] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 348] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 356] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... openat resumed>) = 5 [pid 356] <... openat resumed>) = 4 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 357] ioctl(5, LOOP_SET_FD, 3 [ 22.728650][ T341] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/1/bus supports timestamps until 2038 (0x7fffffff) [ 22.755481][ T350] loop2: detected capacity change from 0 to 512 [ 22.757826][ T354] EXT4-fs (loop3): 1 orphan inode deleted [ 22.761902][ T352] loop4: detected capacity change from 0 to 512 [ 22.769639][ T356] loop1: detected capacity change from 0 to 512 [pid 356] ioctl(4, LOOP_SET_FD, 3 [pid 355] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 353] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... ioctl resumed>) = 0 [pid 355] <... open resumed>) = 5 [pid 351] <... write resumed>) = 8 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] close(4 [pid 355] <... futex resumed>) = 1 [pid 350] <... close resumed>) = 0 [pid 349] <... futex resumed>) = 0 [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] mkdir("./bus", 0777 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 349] <... futex resumed>) = 0 [pid 355] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 350] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 358] <... futex resumed>) = 1 [pid 355] <... write resumed>) = 8 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 353] <... write resumed>) = 8 [pid 359] <... open resumed>) = 5 [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 357] close(3 [pid 356] <... ioctl resumed>) = 0 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] <... futex resumed>) = 1 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 343] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 347] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 359] <... futex resumed>) = 0 [pid 358] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 351] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... futex resumed>) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 358] <... mount resumed>) = 0 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 351] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 353] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 351] <... write resumed>) = 1045 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 358] <... futex resumed>) = 1 [pid 355] <... write resumed>) = 1045 [pid 353] <... write resumed>) = 1045 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 343] <... mprotect resumed>) = 0 [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] <... futex resumed>) = 1 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 347] <... futex resumed>) = 0 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 358] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 357] <... close resumed>) = 0 [pid 356] close(3 [pid 358] <... open resumed>) = 3 [pid 357] mkdir("./bus", 0777 [pid 356] <... close resumed>) = 0 [pid 354] <... mount resumed>) = 0 [pid 341] +++ exited with 0 +++ [pid 340] +++ exited with 0 +++ [pid 357] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 356] mkdir("./bus", 0777 [pid 354] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 357] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 356] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 354] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 356] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 354] ioctl(4, LOOP_CLR_FD) = 0 [pid 354] close(4) = 0 [pid 354] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 354] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] exit_group(0 [pid 354] <... futex resumed>) = ? [pid 349] <... exit_group resumed>) = ? [pid 354] +++ exited with 0 +++ [pid 343] <... clone3 resumed> => {parent_tid=[367]}, 88) = 367 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 367 attached [pid 367] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 358] <... futex resumed>) = 1 [pid 355] <... futex resumed>) = ? [pid 347] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 358] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 355] +++ exited with 0 +++ [pid 349] +++ exited with 0 +++ [pid 347] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 358] <... write resumed>) = 8 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 358] <... futex resumed>) = 1 [pid 347] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./1/bus", [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] <... futex resumed>) = 0 [pid 299] unlink("./1/bus") = 0 [pid 299] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./1/binderfs") = 0 [pid 299] getdents64(3, [pid 358] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 358] <... write resumed>) = 1045 [pid 299] <... close resumed>) = 0 [pid 299] rmdir("./1") = 0 [pid 299] mkdir("./2", 0777 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 297] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 358] <... futex resumed>) = 1 [pid 347] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 297] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 371 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./1/bus") = 0 [ 22.780012][ T357] loop0: detected capacity change from 0 to 512 [ 22.785051][ T354] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.799682][ T354] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/1/file1 supports timestamps until 2038 (0x7fffffff) [ 22.818434][ T352] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 297] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 367] <... mount resumed>) = 0 [pid 367] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 359] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 3 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 359] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... write resumed>) = 8 [pid 297] unlink("./1/binderfs" [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 343] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 359] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] <... futex resumed>) = 0 [pid 359] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... write resumed>) = 1045 [pid 367] <... futex resumed>) = 1 [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 359] <... futex resumed>) = 1 [pid 343] <... futex resumed>) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 371 attached [pid 371] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 371] chdir("./2") = 0 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 371] setpgid(0, 0) = 0 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 371] write(3, "1000", 4) = 4 [pid 371] close(3) = 0 [pid 371] symlink("/dev/binderfs", "./binderfs" [pid 350] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 350] ioctl(6, LOOP_CLR_FD) = 0 [pid 371] <... symlink resumed>) = 0 [pid 350] close(6) = 0 [pid 371] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] <... futex resumed>) = 0 [pid 371] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 371] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 371] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 346] exit_group(0 [pid 351] <... futex resumed>) = ? [pid 346] <... exit_group resumed>) = ? [pid 351] +++ exited with 0 +++ [pid 350] <... futex resumed>) = ? [pid 371] <... mprotect resumed>) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[374]}, 88) = 374 [ 22.852194][ T352] EXT4-fs (loop4): get root inode failed [ 22.869288][ T350] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.884194][ T350] EXT4-fs (loop2): get root inode failed [ 22.887560][ T352] EXT4-fs (loop4): mount failed [ 22.889961][ T350] EXT4-fs (loop2): mount failed [pid 371] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 374 attached NULL, 8) = 0 [pid 374] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 374] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = 0 [pid 374] memfd_create("syzkaller", 0) = 3 [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 374] munmap(0x7f0c41dee000, 138412032) = 0 [pid 374] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_SET_FD, 3 [pid 371] <... futex resumed>) = 1 [pid 297] <... umount2 resumed>) = 0 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 371] <... futex resumed>) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 371] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[375]}, 88) = 375 [pid 371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... ioctl resumed>) = 0 [pid 374] close(3) = 0 [pid 374] mkdir("./file1", 0777 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 350] +++ exited with 0 +++ [pid 346] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 4 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=346, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, [pid 352] ioctl(5, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 352] <... ioctl resumed>) = 0 [pid 297] getdents64(4, [pid 296] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... openat resumed>) = 3 [pid 297] close(4 [pid 296] newfstatat(3, "", [pid 297] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] rmdir("./1/file1" [pid 296] getdents64(3, [pid 297] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./1" [pid 296] newfstatat(AT_FDCWD, "./1/bus", [pid 352] close(5) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 352] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] mkdir("./2", 0777 [pid 296] unlink("./1/bus" [pid 348] exit_group(0 [pid 353] <... futex resumed>) = ? [pid 352] <... futex resumed>) = ? [pid 348] <... exit_group resumed>) = ? [pid 297] <... mkdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 353] +++ exited with 0 +++ [pid 296] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 352] +++ exited with 0 +++ [pid 348] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./1/binderfs", [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=348, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] unlink("./1/binderfs" [pid 374] <... mkdir resumed>) = 0 [pid 298] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 296] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 22.908298][ T357] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.921404][ T356] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.929101][ T374] loop5: detected capacity change from 0 to 512 [ 22.940785][ T357] EXT4-fs (loop0): get root inode failed [pid 374] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] getdents64(3, [pid 298] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 376 [pid 296] close(3 [pid 298] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] rmdir("./1" [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./2", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 377 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./1/bus") = 0 [pid 298] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./1/binderfs") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./1") = 0 [pid 298] mkdir("./2", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 357] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) ./strace-static-x86_64: Process 375 attached ./strace-static-x86_64: Process 377 attached ./strace-static-x86_64: Process 376 attached [pid 375] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 357] ioctl(5, LOOP_CLR_FD [pid 356] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 377] set_robust_list(0x555556d8d6a0, 24 [pid 376] set_robust_list(0x555556d8d6a0, 24 [pid 375] <... set_robust_list resumed>) = 0 [pid 357] <... ioctl resumed>) = 0 [pid 377] <... set_robust_list resumed>) = 0 [pid 376] <... set_robust_list resumed>) = 0 [pid 375] rt_sigprocmask(SIG_SETMASK, [], [pid 371] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 357] close(5 [pid 356] ioctl(4, LOOP_CLR_FD [pid 377] chdir("./2" [pid 376] chdir("./2" [pid 375] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 371] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... close resumed>) = 0 [pid 375] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 371] <... futex resumed>) = 0 [pid 357] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... ioctl resumed>) = 0 [pid 375] <... open resumed>) = 3 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 357] <... futex resumed>) = 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 357] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] close(4 [pid 347] exit_group(0 [pid 375] <... futex resumed>) = 0 [pid 371] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 358] <... futex resumed>) = ? [pid 357] <... futex resumed>) = ? [pid 356] <... close resumed>) = 0 [pid 347] <... exit_group resumed>) = ? [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] <... mprotect resumed>) = 0 [pid 358] +++ exited with 0 +++ [pid 357] +++ exited with 0 +++ [pid 356] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [pid 356] <... futex resumed>) = 0 [pid 347] +++ exited with 0 +++ [pid 343] exit_group(0 [pid 371] <... rt_sigprocmask resumed>[], 8) = 0 [pid 367] <... futex resumed>) = ? [pid 359] <... futex resumed>) = ? [pid 343] <... exit_group resumed>) = ? [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 367] +++ exited with 0 +++ [pid 359] +++ exited with 0 +++ [pid 356] +++ exited with 0 +++ [pid 371] <... clone3 resumed> => {parent_tid=[379]}, 88) = 379 [pid 376] <... chdir resumed>) = 0 [pid 371] rt_sigprocmask(SIG_SETMASK, [], [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=347, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... openat resumed>) = 3 [pid 371] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 294] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... chdir resumed>) = 0 [pid 376] <... prctl resumed>) = 0 [pid 371] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 377] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 376] setpgid(0, 0 [pid 371] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] close(3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 377] <... prctl resumed>) = 0 [pid 376] <... setpgid resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 377] setpgid(0, 0 [pid 294] <... openat resumed>) = 3 ./strace-static-x86_64: Process 379 attached [pid 294] newfstatat(3, "", [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 380 [pid 376] <... openat resumed>) = 3 [pid 377] <... setpgid resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 376] write(3, "1000", 4 [pid 377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] getdents64(3, [pid 376] <... write resumed>) = 4 [pid 376] close(3 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 377] <... openat resumed>) = 3 [pid 376] <... close resumed>) = 0 [pid 294] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] write(3, "1000", 4 [pid 376] symlink("/dev/binderfs", "./binderfs" [pid 379] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 377] <... write resumed>) = 4 [pid 294] <... umount2 resumed>) = 0 [pid 376] <... symlink resumed>) = 0 [pid 377] close(3 [pid 294] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... close resumed>) = 0 [pid 376] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 377] symlink("/dev/binderfs", "./binderfs" [pid 376] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] newfstatat(AT_FDCWD, "./1/bus", [pid 376] <... rt_sigaction resumed>NULL, 8) = 0 [pid 379] <... set_robust_list resumed>) = 0 [pid 377] <... symlink resumed>) = 0 [pid 376] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], [pid 377] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] unlink("./1/bus" [pid 379] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 377] <... futex resumed>) = 0 [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 294] <... unlink resumed>) = 0 [ 22.969606][ T356] EXT4-fs (loop1): get root inode failed [ 22.978609][ T357] EXT4-fs (loop0): mount failed [ 22.987850][ T356] EXT4-fs (loop1): mount failed [pid 377] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 376] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... rt_sigaction resumed>NULL, 8) = 0 [pid 376] <... mprotect resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 380 attached [pid 379] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 294] newfstatat(AT_FDCWD, "./1/binderfs", [pid 376] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 380] set_robust_list(0x555556d8d6a0, 24 [pid 379] <... mount resumed>) = 0 [pid 294] unlink("./1/binderfs" [pid 380] <... set_robust_list resumed>) = 0 [pid 379] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] chdir("./2" [pid 379] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 380] <... chdir resumed>) = 0 [pid 379] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] <... futex resumed>) = 0 [pid 371] <... futex resumed>) = 1 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 380] <... prctl resumed>) = 0 [pid 375] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] close(3 [pid 380] setpgid(0, 0 [pid 376] <... rt_sigprocmask resumed>[], 8) = 0 [pid 375] <... open resumed>) = 5 [pid 294] <... close resumed>) = 0 [pid 380] <... setpgid resumed>) = 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] rmdir("./1" [pid 380] <... openat resumed>) = 3 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] write(3, "1000", 4 [pid 375] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 380] <... write resumed>) = 4 [pid 375] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] close(3 [pid 376] <... clone3 resumed> => {parent_tid=[382]}, 88) = 382 [pid 294] <... rmdir resumed>) = 0 [pid 375] <... write resumed>) = 8 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] rt_sigprocmask(SIG_SETMASK, [], [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] mkdir("./2", 0777 [pid 380] <... close resumed>) = 0 [pid 380] symlink("/dev/binderfs", "./binderfs") = 0 [pid 380] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 380] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 380] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 380] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[383]}, 88) = 383 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 380] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 380] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[384]}, 88) = 384 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 377] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[385]}, 88) = 385 [pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 385 attached ./strace-static-x86_64: Process 382 attached [pid 377] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 375] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 377] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[386]}, 88) = 386 [pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 383 attached [pid 383] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] memfd_create("syzkaller", 0) = 3 [pid 383] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 383] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 383] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 383] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 383] ioctl(4, LOOP_SET_FD, 3 [pid 376] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 376] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 384 attached ./strace-static-x86_64: Process 386 attached [pid 385] set_robust_list(0x7f0c4a20e9a0, 24 [pid 382] set_robust_list(0x7f0c4a20e9a0, 24 [pid 376] <... futex resumed>) = 0 [pid 375] <... write resumed>) = 1045 [pid 386] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 385] <... set_robust_list resumed>) = 0 [pid 384] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 382] <... set_robust_list resumed>) = 0 [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 383] <... ioctl resumed>) = 0 [pid 383] close(3) = 0 [pid 383] mkdir("./file1", 0777 [pid 386] <... set_robust_list resumed>) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], [pid 384] <... set_robust_list resumed>) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], [pid 376] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] ioctl(3, LOOP_CLR_FD [pid 383] <... mkdir resumed>) = 0 [pid 386] rt_sigprocmask(SIG_SETMASK, [], [pid 384] rt_sigprocmask(SIG_SETMASK, [], [pid 382] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 386] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 385] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] memfd_create("syzkaller", 0 [pid 376] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 386] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 384] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 294] close(3 [pid 385] memfd_create("syzkaller", 0 [pid 376] <... mprotect resumed>) = 0 [pid 384] <... open resumed>) = 3 [pid 294] <... close resumed>) = 0 [pid 386] <... open resumed>) = 3 [pid 383] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 376] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] <... memfd_create resumed>) = 4 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... memfd_create resumed>) = 3 [pid 295] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... futex resumed>) = 0 [pid 386] <... futex resumed>) = 1 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 384] <... futex resumed>) = 1 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 380] <... futex resumed>) = 0 [pid 376] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 386] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 385] <... mmap resumed>) = 0x7f0c41dcd000 [pid 384] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 382] <... mmap resumed>) = 0x7f0c41dcd000 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 387 [pid 386] <... mount resumed>) = -1 ENOENT (No such file or directory) ./strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 387] chdir("./2" [pid 385] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 380] <... futex resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... openat resumed>) = 3 [pid 387] <... chdir resumed>) = 0 [pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 387] setpgid(0, 0) = 0 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 376] <... clone3 resumed> => {parent_tid=[388]}, 88) = 388 [pid 384] <... mount resumed>) = 0 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(3, "", [pid 386] <... futex resumed>) = 1 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 386] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 384] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] getdents64(3, [pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 387] write(3, "1000", 4 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = 0 [pid 386] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 384] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 380] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 387] <... write resumed>) = 4 [pid 387] close(3 [pid 385] <... write resumed>) = 262144 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... open resumed>) = 5 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 0 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 386] <... futex resumed>) = 1 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = 0 [pid 386] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 384] <... futex resumed>) = 0 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 388 attached [pid 386] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 385] munmap(0x7f0c41dcd000, 138412032 [pid 384] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 382] <... write resumed>) = 262144 [pid 380] <... futex resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 374] <... mount resumed>) = 0 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] <... close resumed>) = 0 [pid 387] symlink("/dev/binderfs", "./binderfs") = 0 [pid 387] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 387] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[389]}, 88) = 389 [pid 387] rt_sigprocmask(SIG_SETMASK, [], [pid 388] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 386] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 385] <... munmap resumed>) = 0 [pid 382] munmap(0x7f0c41dcd000, 138412032 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 386] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] <... munmap resumed>) = 0 [pid 388] <... set_robust_list resumed>) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], [pid 386] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./1/bus", [pid 388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 386] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 377] <... futex resumed>) = 0 [pid 388] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 385] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 384] <... write resumed>) = 8 [pid 382] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 386] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... open resumed>) = 4 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] unlink("./1/bus" [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... futex resumed>) = 0 [pid 385] <... openat resumed>) = 5 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... openat resumed>) = 5 [pid 386] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] ioctl(5, LOOP_SET_FD, 4 [pid 384] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 388] <... futex resumed>) = 1 [pid 382] ioctl(5, LOOP_SET_FD, 3 [pid 376] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.023599][ T374] EXT4-fs (loop5): 1 orphan inode deleted [ 23.029747][ T374] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.041642][ T374] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/2/file1 supports timestamps until 2038 (0x7fffffff) [ 23.042096][ T383] loop4: detected capacity change from 0 to 512 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 387] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[391]}, 88) = 391 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 389 attached [pid 389] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 389] memfd_create("syzkaller", 0) = 3 [pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 384] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 389] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 389] ioctl(4, LOOP_SET_FD, 3 [pid 388] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 385] <... ioctl resumed>) = 0 [pid 384] <... write resumed>) = 1045 [pid 382] <... ioctl resumed>) = 0 [pid 380] <... futex resumed>) = 0 [pid 376] <... futex resumed>) = 0 [pid 374] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... mount resumed>) = 0 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 384] <... futex resumed>) = 0 [pid 380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(AT_FDCWD, "./1/binderfs", [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 388] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./1/binderfs" [pid 388] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 376] <... futex resumed>) = 0 [pid 388] <... open resumed>) = 6 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] getdents64(3, [pid 388] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 376] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] close(3) = 0 [pid 388] <... write resumed>) = 8 [pid 295] rmdir("./1" [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 389] <... ioctl resumed>) = 0 [pid 388] <... futex resumed>) = 1 [pid 376] <... futex resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] <... futex resumed>) = 0 [pid 295] mkdir("./2", 0777 [pid 388] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] close(3 [pid 295] <... mkdir resumed>) = 0 [pid 388] <... write resumed>) = 1045 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 389] <... close resumed>) = 0 [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] <... futex resumed>) = 0 [pid 388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 389] mkdir("./file1", 0777 [pid 295] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 393 [pid 389] <... mkdir resumed>) = 0 [pid 389] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 393 attached [pid 393] set_robust_list(0x555556d8d6a0, 24 [pid 374] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 393] <... set_robust_list resumed>) = 0 [pid 393] chdir("./2") = 0 [pid 393] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 374] ioctl(4, LOOP_CLR_FD [pid 385] close(4 [pid 382] close(3 [pid 374] <... ioctl resumed>) = 0 [pid 393] <... prctl resumed>) = 0 [pid 393] setpgid(0, 0) = 0 [pid 393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 393] write(3, "1000", 4) = 4 [pid 393] close(3) = 0 [pid 374] close(4) = 0 [pid 382] <... close resumed>) = 0 [pid 385] <... close resumed>) = 0 [pid 374] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] mkdir("./bus", 0777 [pid 385] mkdir("./file1", 0777 [pid 374] <... futex resumed>) = 0 [pid 371] exit_group(0 [pid 385] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 382] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 393] symlink("/dev/binderfs", "./binderfs" [pid 385] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 382] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 379] <... futex resumed>) = ? [pid 375] <... futex resumed>) = ? [pid 371] <... exit_group resumed>) = ? [pid 393] <... symlink resumed>) = 0 [pid 379] +++ exited with 0 +++ [pid 375] +++ exited with 0 +++ [pid 393] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] +++ exited with 0 +++ [pid 371] +++ exited with 0 +++ [pid 393] <... futex resumed>) = 0 [pid 393] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [ 23.083967][ T385] loop2: detected capacity change from 0 to 512 [ 23.090360][ T382] loop3: detected capacity change from 0 to 512 [ 23.095071][ T389] loop0: detected capacity change from 0 to 512 [pid 393] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 393] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[395]}, 88) = 395 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 393] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[396]}, 88) = 396 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 391 attached [pid 391] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 299] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", [pid 391] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 391] <... open resumed>) = 3 [pid 299] getdents64(3, [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] <... futex resumed>) = 1 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 391] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 299] newfstatat(AT_FDCWD, "./2/bus", [pid 391] <... mount resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./2/bus" [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... unlink resumed>) = 0 [pid 391] <... futex resumed>) = 1 [pid 299] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./2/binderfs" [pid 391] <... open resumed>) = 5 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 1 [pid 391] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 299] <... unlink resumed>) = 0 [pid 382] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 382] ioctl(5, LOOP_CLR_FD) = 0 [pid 382] close(5) = 0 [pid 391] <... write resumed>) = 8 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 391] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 382] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] <... write resumed>) = 1045 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 391] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] exit_group(0 [pid 393] <... futex resumed>) = 0 ./strace-static-x86_64: Process 395 attached [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = ? [pid 382] <... futex resumed>) = ? [pid 376] <... exit_group resumed>) = ? [pid 395] set_robust_list(0x7f0c4a20e9a0, 24 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] <... set_robust_list resumed>) = 0 [pid 395] rt_sigprocmask(SIG_SETMASK, [], [pid 388] +++ exited with 0 +++ [pid 382] +++ exited with 0 +++ [pid 376] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=376, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 23.127297][ T382] EXT4-fs (loop3): Invalid log block size: 2475723007 [ 23.139291][ T383] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.163327][ T389] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 395] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 395] memfd_create("syzkaller", 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./2/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./2/bus") = 0 [pid 297] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./2/binderfs") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./2") = 0 [pid 297] mkdir("./3", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = 0 [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 400 [pid 396] <... futex resumed>) = 1 [pid 395] <... memfd_create resumed>) = 5 ./strace-static-x86_64: Process 400 attached [pid 396] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 400] set_robust_list(0x555556d8d6a0, 24 [pid 396] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 395] <... mmap resumed>) = 0x7f0c41dcd000 [pid 400] <... set_robust_list resumed>) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 400] chdir("./3" [pid 396] <... futex resumed>) = 1 [pid 395] <... write resumed>) = 262144 [pid 393] <... futex resumed>) = 0 [pid 400] <... chdir resumed>) = 0 [pid 396] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 395] munmap(0x7f0c41dcd000, 138412032 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 389] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 383] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 400] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 395] <... munmap resumed>) = 0 [pid 393] <... futex resumed>) = 0 [pid 389] ioctl(4, LOOP_CLR_FD [pid 400] <... prctl resumed>) = 0 [pid 396] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 395] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] <... ioctl resumed>) = 0 [pid 383] ioctl(4, LOOP_CLR_FD [pid 400] setpgid(0, 0 [pid 396] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 395] <... openat resumed>) = 6 [pid 389] close(4 [pid 383] <... ioctl resumed>) = 0 [pid 400] <... setpgid resumed>) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] ioctl(6, LOOP_SET_FD, 5 [pid 389] <... close resumed>) = 0 [pid 383] close(4 [pid 400] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 396] <... futex resumed>) = 1 [pid 395] <... ioctl resumed>) = 0 [pid 393] <... futex resumed>) = 0 [pid 383] <... close resumed>) = 0 [pid 383] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 380] exit_group(0 [pid 384] <... futex resumed>) = ? [ 23.176779][ T383] EXT4-fs (loop4): get root inode failed [ 23.182801][ T383] EXT4-fs (loop4): mount failed [ 23.188412][ T389] EXT4-fs (loop0): get root inode failed [ 23.194173][ T389] EXT4-fs (loop0): mount failed [ 23.196008][ T385] EXT4-fs (loop2): 1 orphan inode deleted [ 23.213161][ T395] loop1: detected capacity change from 0 to 512 [pid 383] <... futex resumed>) = ? [pid 380] <... exit_group resumed>) = ? [pid 384] +++ exited with 0 +++ [pid 383] +++ exited with 0 +++ [pid 380] +++ exited with 0 +++ [pid 400] <... openat resumed>) = 3 [pid 396] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 389] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] exit_group(0 [pid 400] write(3, "1000", 4 [pid 395] close(5 [pid 391] <... futex resumed>) = ? [pid 389] <... futex resumed>) = ? [pid 387] <... exit_group resumed>) = ? [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=380, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... write resumed>) = 4 [pid 395] <... close resumed>) = 0 [pid 389] +++ exited with 0 +++ [pid 400] close(3 [pid 395] mkdir("./file1", 0777 [pid 400] <... close resumed>) = 0 [pid 395] <... mkdir resumed>) = 0 [pid 400] symlink("/dev/binderfs", "./binderfs" [pid 395] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 400] <... symlink resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 400] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... futex resumed>) = 0 [pid 400] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./2/bus", [pid 400] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 391] +++ exited with 0 +++ [pid 387] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./2/bus" [pid 400] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] newfstatat(AT_FDCWD, "./2/file1", [pid 298] <... unlink resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=387, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 400] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... mprotect resumed>) = 0 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(AT_FDCWD, "./2/binderfs", [pid 294] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 400] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... openat resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] newfstatat(4, "", [pid 298] unlink("./2/binderfs" [pid 294] <... openat resumed>) = 3 [pid 400] <... clone3 resumed> => {parent_tid=[403]}, 88) = 403 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], [pid 299] getdents64(4, [pid 298] <... unlink resumed>) = 0 [pid 294] newfstatat(3, "", [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 400] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] newfstatat(AT_FDCWD, "./2/file1", [pid 294] getdents64(3, [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(4 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 400] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] rmdir("./2/file1" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... rmdir resumed>) = 0 [pid 400] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] getdents64(3, [pid 400] <... mprotect resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 400] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] close(3 [pid 400] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... close resumed>) = 0 [pid 400] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] rmdir("./2" [ 23.219380][ T385] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.230778][ T385] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 404 attached ./strace-static-x86_64: Process 403 attached [pid 385] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... rmdir resumed>) = 0 [pid 404] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 403] set_robust_list(0x7f0c4a20e9a0, 24 [pid 400] <... clone3 resumed> => {parent_tid=[404]}, 88) = 404 [pid 299] mkdir("./3", 0777 [pid 404] <... set_robust_list resumed>) = 0 [pid 403] <... set_robust_list resumed>) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... mkdir resumed>) = 0 [pid 404] rt_sigprocmask(SIG_SETMASK, [], [pid 403] rt_sigprocmask(SIG_SETMASK, [], [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 404] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] ioctl(5, LOOP_CLR_FD [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 4 [pid 294] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 404] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 403] memfd_create("syzkaller", 0 [pid 400] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 404] <... open resumed>) = 3 [pid 403] <... memfd_create resumed>) = 4 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] close(3 [pid 404] <... futex resumed>) = 0 [pid 403] <... mmap resumed>) = 0x7f0c41dcd000 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 404] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 403] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 400] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 404] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 403] <... write resumed>) = 262144 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] munmap(0x7f0c41dcd000, 138412032 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 406 [pid 404] <... futex resumed>) = 0 [pid 403] <... munmap resumed>) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(4, "", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 404] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 403] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 400] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(AT_FDCWD, "./2/bus", [pid 404] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 403] <... openat resumed>) = 5 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(4, [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] ioctl(5, LOOP_SET_FD, 4 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 406 attached [pid 404] <... futex resumed>) = 0 [pid 403] <... ioctl resumed>) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 404] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 403] close(4 [pid 400] <... futex resumed>) = 0 [pid 404] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 403] <... close resumed>) = 0 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] mkdir("./file1", 0777 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 403] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 403] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 400] <... futex resumed>) = 0 [pid 404] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 404] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] unlink("./2/bus") = 0 [pid 294] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./2/binderfs") = 0 [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, [pid 406] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 298] getdents64(4, [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 406] chdir("./3" [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4 [pid 406] <... chdir resumed>) = 0 [pid 395] <... mount resumed>) = 0 [pid 298] close(4 [pid 294] <... close resumed>) = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 395] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... close resumed>) = 0 [pid 294] rmdir("./2/file1" [pid 406] <... prctl resumed>) = 0 [pid 395] <... openat resumed>) = 5 [pid 298] rmdir("./2/file1" [pid 406] setpgid(0, 0 [pid 395] chdir("./file1" [pid 298] <... rmdir resumed>) = 0 [pid 406] <... setpgid resumed>) = 0 [pid 395] <... chdir resumed>) = 0 [pid 298] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 395] ioctl(6, LOOP_CLR_FD [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 406] <... openat resumed>) = 3 [pid 395] <... ioctl resumed>) = 0 [pid 298] close(3 [pid 294] getdents64(3, [pid 406] write(3, "1000", 4 [pid 395] close(6 [pid 298] <... close resumed>) = 0 [pid 406] <... write resumed>) = 4 [pid 298] rmdir("./2" [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./2" [pid 406] close(3 [pid 294] <... rmdir resumed>) = 0 [pid 406] <... close resumed>) = 0 [pid 294] mkdir("./3", 0777 [pid 406] symlink("/dev/binderfs", "./binderfs" [pid 298] <... rmdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 385] <... ioctl resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 406] <... symlink resumed>) = 0 [pid 385] close(5 [pid 298] mkdir("./3", 0777 [pid 294] <... openat resumed>) = 3 [pid 406] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] <... close resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 406] <... futex resumed>) = 0 [pid 385] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... mkdir resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 408 [pid 395] <... close resumed>) = 0 [pid 395] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 393] exit_group(0 [pid 377] exit_group(0 [pid 406] <... rt_sigaction resumed>NULL, 8) = 0 [pid 393] <... exit_group resumed>) = ? [pid 385] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 396] <... futex resumed>) = ? [pid 406] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 386] <... futex resumed>) = ? [pid 396] +++ exited with 0 +++ [pid 395] <... futex resumed>) = ? [pid 385] +++ exited with 0 +++ [pid 377] <... exit_group resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 395] +++ exited with 0 +++ [pid 393] +++ exited with 0 +++ [pid 386] +++ exited with 0 +++ [pid 377] +++ exited with 0 +++ [pid 298] ioctl(3, LOOP_CLR_FD [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=377, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 406] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] close(3 [pid 406] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... close resumed>) = 0 [pid 406] <... mprotect resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 409 attached ./strace-static-x86_64: Process 408 attached [], 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 409] set_robust_list(0x555556d8d6a0, 24 [pid 408] set_robust_list(0x555556d8d6a0, 24 [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 409 [pid 296] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 409] <... set_robust_list resumed>) = 0 [pid 408] <... set_robust_list resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 409] chdir("./3" [pid 408] chdir("./3" [pid 406] <... clone3 resumed> => {parent_tid=[411]}, 88) = 411 [pid 296] newfstatat(3, "", [pid 295] newfstatat(3, "", ./strace-static-x86_64: Process 411 attached [pid 409] <... chdir resumed>) = 0 [pid 408] <... chdir resumed>) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 411] set_robust_list(0x7f0c4a20e9a0, 24 [pid 409] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 408] prctl(PR_SET_PDEATHSIG, SIGKILL [ 23.271392][ T395] EXT4-fs (loop1): 1 orphan inode deleted [ 23.279002][ T395] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.294216][ T403] loop3: detected capacity change from 0 to 512 [ 23.295781][ T395] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] getdents64(3, [pid 409] <... prctl resumed>) = 0 [pid 408] <... prctl resumed>) = 0 [pid 295] getdents64(3, [pid 409] setpgid(0, 0 [pid 408] setpgid(0, 0 [pid 409] <... setpgid resumed>) = 0 [pid 408] <... setpgid resumed>) = 0 [pid 409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 409] <... openat resumed>) = 3 [pid 408] <... openat resumed>) = 3 [pid 409] write(3, "1000", 4 [pid 408] write(3, "1000", 4 [pid 406] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 411] <... set_robust_list resumed>) = 0 [pid 409] <... write resumed>) = 4 [pid 408] <... write resumed>) = 4 [pid 406] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 409] close(3 [pid 408] close(3 [pid 409] <... close resumed>) = 0 [pid 408] <... close resumed>) = 0 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 411] rt_sigprocmask(SIG_SETMASK, [], [pid 409] symlink("/dev/binderfs", "./binderfs" [pid 408] symlink("/dev/binderfs", "./binderfs" [pid 409] <... symlink resumed>) = 0 [pid 408] <... symlink resumed>) = 0 [pid 409] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 409] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 409] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 408] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 409] <... rt_sigaction resumed>NULL, 8) = 0 [pid 408] <... rt_sigaction resumed>NULL, 8) = 0 [pid 409] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 408] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 411] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 406] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 411] memfd_create("syzkaller", 0 [pid 409] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] newfstatat(AT_FDCWD, "./2/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 411] <... memfd_create resumed>) = 3 [pid 409] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 408] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 406] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/bus", [pid 411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 409] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 408] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 406] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] unlink("./2/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 411] <... mmap resumed>) = 0x7f0c41dcd000 [pid 409] <... mprotect resumed>) = 0 [pid 408] <... mprotect resumed>) = 0 [pid 406] <... mprotect resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./2/bus" [pid 411] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 409] rt_sigprocmask(SIG_BLOCK, ~[], [pid 408] rt_sigprocmask(SIG_BLOCK, ~[], [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 411] <... write resumed>) = 262144 [pid 409] <... rt_sigprocmask resumed>[], 8) = 0 [pid 408] <... rt_sigprocmask resumed>[], 8) = 0 [pid 406] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 411] munmap(0x7f0c41dcd000, 138412032 [pid 409] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] newfstatat(AT_FDCWD, "./2/file1", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 414 attached ./strace-static-x86_64: Process 413 attached ./strace-static-x86_64: Process 412 attached [pid 411] <... munmap resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/binderfs", [pid 411] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 409] <... clone3 resumed> => {parent_tid=[412]}, 88) = 412 [pid 408] <... clone3 resumed> => {parent_tid=[413]}, 88) = 413 [pid 406] <... clone3 resumed> => {parent_tid=[414]}, 88) = 414 [pid 296] unlink("./2/file1" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 411] <... openat resumed>) = 4 [pid 409] rt_sigprocmask(SIG_SETMASK, [], [pid 408] rt_sigprocmask(SIG_SETMASK, [], [pid 406] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./2/binderfs" [pid 414] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 413] set_robust_list(0x7f0c4a20e9a0, 24 [pid 412] set_robust_list(0x7f0c4a20e9a0, 24 [pid 411] ioctl(4, LOOP_SET_FD, 3 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 403] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 296] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 414] <... set_robust_list resumed>) = 0 [pid 413] <... set_robust_list resumed>) = 0 [pid 412] <... set_robust_list resumed>) = 0 [pid 403] ioctl(5, LOOP_CLR_FD [pid 414] rt_sigprocmask(SIG_SETMASK, [], [pid 413] rt_sigprocmask(SIG_SETMASK, [], [pid 412] rt_sigprocmask(SIG_SETMASK, [], [pid 414] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 412] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 414] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 412] memfd_create("syzkaller", 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... memfd_create resumed>) = 3 [pid 409] <... futex resumed>) = 0 [pid 412] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 409] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 412] <... mmap resumed>) = 0x7f0c41dee000 [pid 409] <... mmap resumed>) = 0x7f0c41dcd000 [pid 412] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 409] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 412] <... write resumed>) = 262144 [pid 409] <... mprotect resumed>) = 0 [pid 412] munmap(0x7f0c41dee000, 138412032 [pid 409] rt_sigprocmask(SIG_BLOCK, ~[], [pid 412] <... munmap resumed>) = 0 [pid 409] <... rt_sigprocmask resumed>[], 8) = 0 [pid 412] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 409] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 412] <... openat resumed>) = 4 [pid 412] ioctl(4, LOOP_SET_FD, 3 [pid 409] <... clone3 resumed> => {parent_tid=[415]}, 88) = 415 ./strace-static-x86_64: Process 415 attached [pid 411] <... ioctl resumed>) = 0 [pid 408] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 415] set_robust_list(0x7f0c41ded9a0, 24 [pid 411] close(3 [pid 408] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 1 [pid 296] close(3 [pid 415] <... set_robust_list resumed>) = 0 [pid 411] <... close resumed>) = 0 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... close resumed>) = 0 [pid 415] rt_sigprocmask(SIG_SETMASK, [], [pid 411] mkdir("./file1", 0777 [pid 408] <... futex resumed>) = 0 [pid 296] rmdir("./2" [pid 415] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 411] <... mkdir resumed>) = 0 [pid 408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... rmdir resumed>) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 411] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 408] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] mkdir("./3", 0777 [pid 408] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... mkdir resumed>) = 0 [pid 408] <... mprotect resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 408] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... openat resumed>) = 3 [pid 408] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3./strace-static-x86_64: Process 416 attached [pid 414] <... futex resumed>) = 0 [pid 413] <... futex resumed>) = 0 [pid 412] <... ioctl resumed>) = 0 [pid 409] rt_sigprocmask(SIG_SETMASK, [], [pid 408] <... clone3 resumed> => {parent_tid=[416]}, 88) = 416 [pid 296] <... close resumed>) = 0 [pid 416] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 414] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 413] memfd_create("syzkaller", 0 [pid 412] close(3 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] rt_sigprocmask(SIG_SETMASK, [], [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 414] <... open resumed>) = 3 [pid 413] <... memfd_create resumed>) = 3 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 419 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 419 attached [pid 419] set_robust_list(0x555556d8d6a0, 24 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 415] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 415] <... open resumed>) = 5 [pid 414] <... futex resumed>) = 1 [pid 412] <... close resumed>) = 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... mmap resumed>) = 0x7f0c41dcd000 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 414] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 412] mkdir("./bus", 0777 [pid 406] <... futex resumed>) = 0 [ 23.337902][ T403] EXT4-fs (loop3): 1 orphan inode deleted [ 23.348504][ T403] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.359579][ T403] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/3/file1 supports timestamps until 2038 (0x7fffffff) [ 23.374217][ T411] loop5: detected capacity change from 0 to 512 [ 23.380553][ T412] loop4: detected capacity change from 0 to 512 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 419] <... set_robust_list resumed>) = 0 [pid 419] chdir("./3") = 0 [pid 419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 419] setpgid(0, 0) = 0 [pid 419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 414] <... mount resumed>) = 0 [pid 412] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... openat resumed>) = 3 [pid 419] write(3, "1000", 4) = 4 [pid 419] close(3) = 0 [pid 419] symlink("/dev/binderfs", "./binderfs") = 0 [pid 419] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 419] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 419] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 419] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[420]}, 88) = 420 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 419] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 419] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 419] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[421]}, 88) = 421 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 421 attached [pid 421] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... futex resumed>) = 1 [pid 421] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... futex resumed>) = 1 [pid 421] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 421] <... futex resumed>) = 1 [pid 421] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 414] <... futex resumed>) = 1 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 414] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 409] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 0 [pid 415] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... open resumed>) = 3 [pid 414] <... open resumed>) = 5 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 414] <... futex resumed>) = 1 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 406] <... futex resumed>) = 0 [pid 415] <... write resumed>) = 8 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... write resumed>) = 262144 [pid 419] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 414] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 409] <... futex resumed>) = 1 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = 1 [pid 421] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 414] <... write resumed>) = 8 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... set_robust_list resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 414] <... futex resumed>) = 1 [pid 413] munmap(0x7f0c41dcd000, 138412032 [pid 409] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 0 [pid 415] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... write resumed>) = 1045 [pid 406] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = 1 [pid 421] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 420 attached [pid 420] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 420] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 420] memfd_create("syzkaller", 0) = 5 [pid 420] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 420] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 420] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 420] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 420] ioctl(6, LOOP_SET_FD, 5 [pid 416] rt_sigprocmask(SIG_SETMASK, [], [pid 414] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 413] <... munmap resumed>) = 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... ioctl resumed>) = 0 [pid 420] <... ioctl resumed>) = 0 [pid 420] close(5) = 0 [pid 420] mkdir("./file1", 0777) = 0 [pid 420] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 416] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 416] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 408] <... futex resumed>) = 0 [pid 416] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... mount resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 416] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 403] close(5 [pid 416] <... open resumed>) = 6 [pid 414] <... write resumed>) = 1045 [pid 413] <... openat resumed>) = 5 [pid 411] <... mount resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 403] <... close resumed>) = 0 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] ioctl(5, LOOP_SET_FD, 3 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = 0 [pid 414] <... futex resumed>) = 1 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] <... futex resumed>) = 0 [pid 403] <... futex resumed>) = 0 [pid 400] exit_group(0 [pid 416] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 414] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... exit_group resumed>) = ? [pid 416] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 408] <... futex resumed>) = 0 [pid 403] +++ exited with 0 +++ [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 408] <... futex resumed>) = 0 [pid 416] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 408] <... futex resumed>) = 0 [pid 416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 411] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 411] ioctl(4, LOOP_CLR_FD) = 0 [pid 411] close(4) = 0 [pid 411] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.395863][ T411] EXT4-fs (loop5): 1 orphan inode deleted [ 23.405485][ T411] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.411930][ T420] loop2: detected capacity change from 0 to 512 [ 23.418409][ T411] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 411] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] <... ioctl resumed>) = 0 [pid 406] exit_group(0 [pid 404] <... futex resumed>) = ? [pid 295] <... umount2 resumed>) = 0 [pid 414] <... futex resumed>) = ? [pid 413] close(3 [pid 411] <... futex resumed>) = ? [pid 406] <... exit_group resumed>) = ? [pid 414] +++ exited with 0 +++ [pid 413] <... close resumed>) = 0 [pid 411] +++ exited with 0 +++ [pid 404] +++ exited with 0 +++ [pid 400] +++ exited with 0 +++ [pid 413] mkdir("./bus", 0777 [pid 406] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=400, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 413] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 413] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=406, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 4 [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 295] newfstatat(4, "", [pid 299] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./3/binderfs") = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./3/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./3") = 0 [pid 297] mkdir("./4", 0777 [pid 299] <... umount2 resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 295] getdents64(4, [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./3/bus", [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] unlink("./3/bus" [pid 297] close(3 [pid 299] <... unlink resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 299] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./3/binderfs", [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 428 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./3/binderfs") = 0 ./strace-static-x86_64: Process 428 attached [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(4 [pid 428] set_robust_list(0x555556d8d6a0, 24 [pid 295] <... close resumed>) = 0 [pid 428] <... set_robust_list resumed>) = 0 [pid 295] rmdir("./2/file1" [pid 428] chdir("./4" [pid 295] <... rmdir resumed>) = 0 [pid 428] <... chdir resumed>) = 0 [pid 295] getdents64(3, [pid 428] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 428] <... prctl resumed>) = 0 [pid 295] close(3 [pid 428] setpgid(0, 0 [pid 295] <... close resumed>) = 0 [pid 428] <... setpgid resumed>) = 0 [pid 295] rmdir("./2" [pid 428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... rmdir resumed>) = 0 [pid 428] <... openat resumed>) = 3 [pid 295] mkdir("./3", 0777 [pid 428] write(3, "1000", 4 [pid 295] <... mkdir resumed>) = 0 [pid 428] <... write resumed>) = 4 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 428] close(3 [pid 295] <... openat resumed>) = 3 [pid 428] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 428] symlink("/dev/binderfs", "./binderfs" [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 428] <... symlink resumed>) = 0 [ 23.436509][ T412] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.448614][ T413] loop0: detected capacity change from 0 to 512 [ 23.468282][ T412] EXT4-fs (loop4): get root inode failed [ 23.475810][ T412] EXT4-fs (loop4): mount failed [ 23.485747][ T420] EXT4-fs (loop2): 1 orphan inode deleted [pid 295] close(3 [pid 428] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 428] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 428] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 429 [pid 428] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 428] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 428] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 428] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 428] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[430]}, 88) = 430 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 428] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 428] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 428] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[431]}, 88) = 431 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 429 attached ./strace-static-x86_64: Process 430 attached ./strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 430] set_robust_list(0x7f0c4a20e9a0, 24 [pid 429] set_robust_list(0x555556d8d6a0, 24 [pid 431] <... set_robust_list resumed>) = 0 [pid 430] <... set_robust_list resumed>) = 0 [pid 429] <... set_robust_list resumed>) = 0 [pid 412] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 431] rt_sigprocmask(SIG_SETMASK, [], [pid 430] rt_sigprocmask(SIG_SETMASK, [], [pid 431] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] chdir("./3" [pid 412] ioctl(4, LOOP_CLR_FD [pid 430] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 431] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 429] <... chdir resumed>) = 0 [pid 430] memfd_create("syzkaller", 0 [pid 429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 412] <... ioctl resumed>) = 0 [pid 431] <... open resumed>) = 3 [pid 430] <... memfd_create resumed>) = 4 [pid 429] <... prctl resumed>) = 0 [pid 420] <... mount resumed>) = 0 [pid 412] close(4 [pid 420] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 420] chdir("./file1") = 0 [pid 420] ioctl(6, LOOP_CLR_FD) = 0 [pid 420] close(6) = 0 [pid 420] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] <... futex resumed>) = 0 [pid 431] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 428] <... futex resumed>) = 0 [ 23.492218][ T413] EXT4-fs (loop0): 1 orphan inode deleted [ 23.504386][ T413] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.508395][ T420] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.527830][ T420] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 431] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 430] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 430] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 429] setpgid(0, 0 [pid 412] <... close resumed>) = 0 [pid 430] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 430] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [pid 430] ioctl(5, LOOP_SET_FD, 4 [pid 429] <... setpgid resumed>) = 0 [pid 412] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 419] exit_group(0 [pid 412] <... futex resumed>) = 0 [pid 429] <... openat resumed>) = 3 [pid 421] <... futex resumed>) = ? [pid 419] <... exit_group resumed>) = ? [pid 412] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] exit_group(0 [pid 429] write(3, "1000", 4 [pid 421] +++ exited with 0 +++ [pid 415] <... futex resumed>) = ? [pid 412] <... futex resumed>) = ? [pid 409] <... exit_group resumed>) = ? [pid 429] <... write resumed>) = 4 [pid 415] +++ exited with 0 +++ [pid 420] <... futex resumed>) = ? [pid 429] close(3) = 0 [pid 429] symlink("/dev/binderfs", "./binderfs") = 0 [pid 429] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 429] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 429] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 420] +++ exited with 0 +++ [pid 419] +++ exited with 0 +++ [pid 429] <... mprotect resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=419, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... clone3 resumed> => {parent_tid=[432]}, 88) = 432 [pid 296] <... umount2 resumed>) = 0 [pid 429] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = 0 [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 429] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./3/file1", [pid 296] newfstatat(AT_FDCWD, "./3/bus", [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./3/bus" [pid 429] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 432 attached [pid 430] <... ioctl resumed>) = 0 [pid 299] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... unlink resumed>) = 0 [pid 429] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 4 [pid 296] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... mprotect resumed>) = 0 [pid 299] newfstatat(4, "", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] newfstatat(AT_FDCWD, "./3/binderfs", [pid 299] getdents64(4, [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] unlink("./3/binderfs" [pid 430] close(4 [pid 429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] getdents64(4, [pid 430] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 430] mkdir("./file1", 0777 [pid 429] <... clone3 resumed> => {parent_tid=[433]}, 88) = 433 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 429] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(4 [pid 430] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... close resumed>) = 0 [pid 432] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 432] rt_sigprocmask(SIG_SETMASK, [], [pid 299] rmdir("./3/file1" [pid 432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 432] memfd_create("syzkaller", 0 [pid 299] <... rmdir resumed>) = 0 [pid 432] <... memfd_create resumed>) = 3 [pid 432] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] getdents64(3, [pid 432] <... mmap resumed>) = 0x7f0c41dcd000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./3" [pid 413] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 413] ioctl(5, LOOP_CLR_FD) = 0 [pid 413] close(5) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./4", 0777 [pid 413] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 413] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 413] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 433 attached [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 408] exit_group(0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 416] <... futex resumed>) = ? [pid 413] <... futex resumed>) = ? [pid 408] <... exit_group resumed>) = ? [pid 299] close(3 [pid 416] +++ exited with 0 +++ [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 413] +++ exited with 0 +++ ./strace-static-x86_64: Process 434 attached [pid 433] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 432] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 434 [pid 433] <... set_robust_list resumed>) = 0 [pid 433] rt_sigprocmask(SIG_SETMASK, [], [pid 434] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 432] <... write resumed>) = 262144 [pid 433] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 432] munmap(0x7f0c41dcd000, 138412032 [pid 433] <... open resumed>) = 4 [pid 432] <... munmap resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 434] chdir("./4" [pid 433] <... futex resumed>) = 1 [pid 432] <... openat resumed>) = 5 [pid 429] <... futex resumed>) = 0 [pid 434] <... chdir resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 432] ioctl(5, LOOP_SET_FD, 3 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 432] <... ioctl resumed>) = 0 [pid 429] <... futex resumed>) = 0 [pid 434] <... prctl resumed>) = 0 [pid 433] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] setpgid(0, 0 [pid 433] <... mount resumed>) = 0 [pid 434] <... setpgid resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 434] <... openat resumed>) = 3 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] write(3, "1000", 4 [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] <... futex resumed>) = 0 [pid 434] <... write resumed>) = 4 [pid 433] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] close(3 [pid 433] <... open resumed>) = 6 [pid 434] <... close resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] symlink("/dev/binderfs", "./binderfs" [pid 433] <... futex resumed>) = 1 [ 23.528338][ T413] ext4 filesystem being mounted at /root/syzkaller.iF59aB/3/bus supports timestamps until 2038 (0x7fffffff) [ 23.553110][ T430] loop3: detected capacity change from 0 to 512 [ 23.582162][ T432] loop1: detected capacity change from 0 to 512 [pid 429] <... futex resumed>) = 0 [pid 434] <... symlink resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] <... futex resumed>) = 0 [pid 434] <... futex resumed>) = 0 [pid 433] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 434] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 434] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 434] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 434] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 434] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[437]}, 88) = 437 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 434] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 434] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 434] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[438]}, 88) = 438 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 432] close(3) = 0 [pid 432] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 432] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 412] +++ exited with 0 +++ [pid 409] +++ exited with 0 +++ [pid 408] +++ exited with 0 +++ ./strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] memfd_create("syzkaller", 0) = 3 [pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 296] <... umount2 resumed>) = 0 [pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 437] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 437] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_SET_FD, 3 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=409, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] <... write resumed>) = 8 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=408, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./3/file1", [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 298] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 429] <... futex resumed>) = 0 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 4 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(3, "", [pid 296] newfstatat(4, "", [pid 294] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 433] <... write resumed>) = 1045 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 432] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 432] ioctl(5, LOOP_CLR_FD) = 0 [pid 432] close(5) = 0 [pid 432] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 437] <... ioctl resumed>) = 0 [pid 437] close(3) = 0 [pid 437] mkdir("./file1", 0777) = 0 [pid 437] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 438 attached [pid 438] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 1 [pid 438] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 1 [pid 438] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./3/file1") = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./3") = 0 [pid 296] mkdir("./4", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 439 [pid 294] <... openat resumed>) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] getdents64(3, [pid 294] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./3/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./3/bus" [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] exit_group(0 [pid 298] <... umount2 resumed>) = 0 [pid 294] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] <... futex resumed>) = ? [pid 429] <... exit_group resumed>) = ? [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 433] +++ exited with 0 +++ [pid 294] newfstatat(AT_FDCWD, "./3/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./3/bus", [pid 294] unlink("./3/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./3") = 0 [pid 294] mkdir("./4", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 432] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 298] unlink("./3/bus" [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] <... unlink resumed>) = 0 [pid 294] close(3 [pid 298] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 440 [pid 298] unlink("./3/binderfs" [pid 438] <... open resumed>) = 5 [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 438] <... futex resumed>) = 1 [pid 434] <... futex resumed>) = 0 [pid 298] close(3 [pid 438] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 438] <... write resumed>) = 8 [pid 434] <... futex resumed>) = 0 [pid 298] rmdir("./3" [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 0 [pid 434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... rmdir resumed>) = 0 [pid 438] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./4", 0777 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 438] <... write resumed>) = 1045 [pid 298] <... openat resumed>) = 3 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 438] <... futex resumed>) = 1 [pid 434] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 438] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] close(3) = 0 [ 23.592822][ T430] EXT4-fs (loop3): 1 orphan inode deleted [ 23.604306][ T437] loop5: detected capacity change from 0 to 512 [ 23.611967][ T432] EXT4-fs (loop1): Invalid log block size: 2475723007 [ 23.613211][ T430] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 441 attached ./strace-static-x86_64: Process 440 attached ./strace-static-x86_64: Process 439 attached , child_tidptr=0x555556d8d690) = 441 [pid 440] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 440] chdir("./4") = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 [pid 440] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 440] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 440] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 440] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[442]}, 88) = 442 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 439] set_robust_list(0x555556d8d6a0, 24 [pid 440] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 439] <... set_robust_list resumed>) = 0 [pid 440] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 439] chdir("./4" [pid 440] <... mprotect resumed>) = 0 [pid 439] <... chdir resumed>) = 0 [pid 440] rt_sigprocmask(SIG_BLOCK, ~[], [pid 439] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 442 attached [pid 441] set_robust_list(0x555556d8d6a0, 24 [pid 440] <... rt_sigprocmask resumed>[], 8) = 0 [pid 439] <... prctl resumed>) = 0 [pid 441] <... set_robust_list resumed>) = 0 [pid 441] chdir("./4") = 0 [pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] setpgid(0, 0) = 0 [pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 441] write(3, "1000", 4) = 4 [pid 441] close(3) = 0 [pid 441] symlink("/dev/binderfs", "./binderfs") = 0 [pid 441] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 441] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 441] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[444]}, 88) = 444 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] set_robust_list(0x7f0c4a20e9a0, 24 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 442] <... set_robust_list resumed>) = 0 [pid 441] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 442] rt_sigprocmask(SIG_SETMASK, [], [pid 441] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 442] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 441] <... mprotect resumed>) = 0 [pid 442] memfd_create("syzkaller", 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [pid 442] <... memfd_create resumed>) = 3 [pid 441] <... rt_sigprocmask resumed>[], 8) = 0 [pid 442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 442] <... mmap resumed>) = 0x7f0c41dcd000 [pid 442] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 441] <... clone3 resumed> => {parent_tid=[445]}, 88) = 445 [pid 440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 439] setpgid(0, 0 [pid 432] +++ exited with 0 +++ [pid 429] +++ exited with 0 +++ [pid 441] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... setpgid resumed>) = 0 [pid 441] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 440] <... clone3 resumed> => {parent_tid=[446]}, 88) = 446 [pid 439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=429, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... openat resumed>) = 3 [pid 441] <... futex resumed>) = 0 [pid 440] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] write(3, "1000", 4 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... write resumed>) = 4 [pid 295] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 442] <... write resumed>) = 262144 [pid 440] <... futex resumed>) = 0 [pid 439] close(3 [pid 430] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 446 attached [pid 442] munmap(0x7f0c41dcd000, 138412032 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... close resumed>) = 0 [pid 430] ioctl(5, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 445 attached [pid 446] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 442] <... munmap resumed>) = 0 [pid 439] symlink("/dev/binderfs", "./binderfs" [pid 295] <... openat resumed>) = 3 [pid 446] <... set_robust_list resumed>) = 0 [pid 445] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 439] <... symlink resumed>) = 0 [pid 295] newfstatat(3, "", ./strace-static-x86_64: Process 444 attached [pid 446] rt_sigprocmask(SIG_SETMASK, [], [pid 445] <... set_robust_list resumed>) = 0 [pid 442] <... openat resumed>) = 4 [pid 439] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 445] rt_sigprocmask(SIG_SETMASK, [], [pid 444] set_robust_list(0x7f0c4a20e9a0, 24 [pid 442] ioctl(4, LOOP_SET_FD, 3 [pid 439] <... futex resumed>) = 0 [pid 446] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 445] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 444] <... set_robust_list resumed>) = 0 [pid 439] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 295] getdents64(3, [pid 446] <... open resumed>) = 5 [pid 445] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 444] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... rt_sigaction resumed>NULL, 8) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] <... open resumed>) = 3 [pid 444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 446] <... futex resumed>) = 1 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] memfd_create("syzkaller", 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 442] <... ioctl resumed>) = 0 [pid 442] close(3) = 0 [pid 442] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 442] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] <... futex resumed>) = 1 [pid 444] <... memfd_create resumed>) = 4 [pid 441] <... futex resumed>) = 0 [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.644850][ T430] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/4/file1 supports timestamps until 2038 (0x7fffffff) [ 23.679913][ T442] loop0: detected capacity change from 0 to 512 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 445] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 446] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 445] <... mount resumed>) = 0 [pid 444] <... mmap resumed>) = 0x7f0c41dcd000 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(AT_FDCWD, "./3/bus", [pid 439] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 446] <... mount resumed>) = 0 [pid 439] <... mprotect resumed>) = 0 [pid 444] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 430] <... ioctl resumed>) = 0 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] rt_sigprocmask(SIG_BLOCK, ~[], [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./3/bus" [pid 445] <... futex resumed>) = 1 [pid 441] <... futex resumed>) = 0 [pid 430] close(5 [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 439] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... unlink resumed>) = 0 [pid 446] <... futex resumed>) = 1 [pid 445] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 444] <... write resumed>) = 262144 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... futex resumed>) = 0 [pid 430] <... close resumed>) = 0 [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] <... open resumed>) = 5 [pid 444] munmap(0x7f0c41dcd000, 138412032 [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 295] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 448 attached [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... munmap resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 430] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 428] exit_group(0 [pid 431] <... futex resumed>) = ? [pid 428] <... exit_group resumed>) = ? [pid 431] +++ exited with 0 +++ [pid 448] set_robust_list(0x7f0c4a20e9a0, 24 [pid 446] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 445] <... futex resumed>) = 1 [pid 444] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... clone3 resumed> => {parent_tid=[448]}, 88) = 448 [pid 295] newfstatat(AT_FDCWD, "./3/binderfs", [pid 448] <... set_robust_list resumed>) = 0 [pid 446] <... open resumed>) = 3 [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] <... openat resumed>) = 6 [pid 441] <... futex resumed>) = 0 [pid 439] rt_sigprocmask(SIG_SETMASK, [], [pid 430] <... futex resumed>) = ? [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 448] rt_sigprocmask(SIG_SETMASK, [], [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] ioctl(6, LOOP_SET_FD, 4 [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 445] <... futex resumed>) = 0 [pid 441] <... futex resumed>) = 1 [pid 439] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] +++ exited with 0 +++ [pid 428] +++ exited with 0 +++ [pid 295] unlink("./3/binderfs" [pid 445] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [ 23.690482][ T437] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.716519][ T437] EXT4-fs (loop5): get root inode failed [ 23.724437][ T437] EXT4-fs (loop5): mount failed [ 23.730399][ T444] loop4: detected capacity change from 0 to 512 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] <... futex resumed>) = 1 [pid 440] <... futex resumed>) = 0 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 445] <... write resumed>) = -1 EIO (Input/output error) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=428, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 446] <... write resumed>) = 8 [pid 445] <... futex resumed>) = 1 [pid 444] <... ioctl resumed>) = 0 [pid 441] <... futex resumed>) = 0 [pid 439] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 437] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 448] memfd_create("syzkaller", 0 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... mprotect resumed>) = 0 [pid 441] <... futex resumed>) = 0 [pid 445] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 446] <... futex resumed>) = 1 [pid 440] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 448] <... memfd_create resumed>) = 3 [pid 445] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] rt_sigprocmask(SIG_BLOCK, ~[], [pid 446] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 297] <... openat resumed>) = 3 [pid 295] close(3 [pid 444] close(4 [pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... rt_sigprocmask resumed>[], 8) = 0 [pid 437] ioctl(4, LOOP_CLR_FD [pid 297] newfstatat(3, "", [pid 295] <... close resumed>) = 0 [pid 448] <... mmap resumed>) = 0x7f0c41dcd000 [pid 446] <... write resumed>) = 1045 [pid 445] <... write resumed>) = 1045 [pid 444] <... close resumed>) = 0 [pid 439] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] rmdir("./3" [pid 437] <... ioctl resumed>) = 0 [pid 437] close(4) = 0 [pid 437] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] mkdir("./file1", 0777 [pid 297] getdents64(3, [pid 295] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 451 attached [pid 451] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 448] <... write resumed>) = 262144 [pid 446] <... futex resumed>) = 1 [pid 445] <... futex resumed>) = 1 [pid 441] <... futex resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... clone3 resumed> => {parent_tid=[451]}, 88) = 451 [pid 434] exit_group(0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] mkdir("./4", 0777 [pid 448] munmap(0x7f0c41dcd000, 138412032 [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] rt_sigprocmask(SIG_SETMASK, [], [pid 438] <... futex resumed>) = ? [pid 437] <... futex resumed>) = ? [pid 434] <... exit_group resumed>) = ? [pid 297] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... mkdir resumed>) = 0 [pid 448] <... munmap resumed>) = 0 [pid 444] <... mkdir resumed>) = 0 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 438] +++ exited with 0 +++ [pid 437] +++ exited with 0 +++ [pid 434] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 448] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 444] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./4/binderfs", [pid 295] <... openat resumed>) = 3 [pid 439] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./4/binderfs" [pid 299] <... restart_syscall resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] ioctl(3, LOOP_CLR_FD [pid 451] rt_sigprocmask(SIG_SETMASK, [], [pid 448] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 448] ioctl(4, LOOP_SET_FD, 3 [pid 299] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./4/file1", [pid 295] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... close resumed>) = 0 [pid 451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 451] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... ioctl resumed>) = 0 [pid 448] close(3) = 0 [pid 299] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] unlink("./4/file1" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 444] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 439] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... unlink resumed>) = 0 [pid 448] mkdir("./bus", 0777 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 444] ioctl(6, LOOP_CLR_FD [pid 297] getdents64(3, [pid 439] <... futex resumed>) = 1 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 452 [pid 451] <... futex resumed>) = 0 [pid 444] <... ioctl resumed>) = 0 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 444] close(6 [pid 299] getdents64(3, [pid 297] close(3 [pid 444] <... close resumed>) = 0 [pid 451] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 444] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] <... close resumed>) = 0 [pid 444] <... futex resumed>) = 0 [pid 441] exit_group(0 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./4" [pid 445] <... futex resumed>) = ? [pid 441] <... exit_group resumed>) = ? [pid 451] <... mount resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 451] <... futex resumed>) = 1 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 439] <... futex resumed>) = 0 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] mkdir("./5", 0777 [pid 451] <... futex resumed>) = 0 [pid 439] <... futex resumed>) = 1 [pid 451] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... mkdir resumed>) = 0 [pid 451] <... open resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./4/bus", [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] unlink("./4/bus" [pid 451] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 439] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 451] <... write resumed>) = 8 [pid 299] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] ioctl(3, LOOP_CLR_FD [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./4/binderfs", [pid 297] close(3 [pid 451] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 448] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 451] <... write resumed>) = 1045 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./4/binderfs" [pid 297] <... close resumed>) = 0 [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 453 [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./4/file1" [pid 442] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 453 attached ./strace-static-x86_64: Process 452 attached [pid 442] ioctl(4, LOOP_CLR_FD) = 0 [ 23.737020][ T54] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 23.754796][ T442] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.769956][ T444] EXT4-fs (loop4): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [ 23.770348][ T448] loop2: detected capacity change from 0 to 512 [ 23.780408][ T442] EXT4-fs (loop0): get root inode failed [ 23.792337][ T442] EXT4-fs (loop0): mount failed [pid 442] close(4) = 0 [pid 442] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./4") = 0 [pid 299] mkdir("./5", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 453] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 453] chdir("./5") = 0 [pid 453] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 453] setpgid(0, 0) = 0 [pid 453] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 453] write(3, "1000", 4 [pid 452] set_robust_list(0x555556d8d6a0, 24 [pid 448] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 452] <... set_robust_list resumed>) = 0 [pid 448] ioctl(4, LOOP_CLR_FD [pid 452] chdir("./4" [pid 448] <... ioctl resumed>) = 0 [pid 453] <... write resumed>) = 4 [pid 452] <... chdir resumed>) = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 448] close(4 [pid 440] exit_group(0 [pid 452] <... prctl resumed>) = 0 [pid 448] <... close resumed>) = 0 [pid 446] <... futex resumed>) = ? [pid 442] <... futex resumed>) = ? [pid 440] <... exit_group resumed>) = ? [pid 453] close(3) = 0 [pid 452] setpgid(0, 0 [pid 448] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] +++ exited with 0 +++ [pid 439] exit_group(0 [pid 453] symlink("/dev/binderfs", "./binderfs" [pid 452] <... setpgid resumed>) = 0 [pid 451] <... futex resumed>) = ? [pid 448] <... futex resumed>) = ? [pid 439] <... exit_group resumed>) = ? [pid 453] <... symlink resumed>) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 451] +++ exited with 0 +++ [pid 453] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... openat resumed>) = 3 [pid 453] <... futex resumed>) = 0 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 452] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 452] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 453] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 452] <... mprotect resumed>) = 0 [pid 453] <... rt_sigaction resumed>NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 452] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 454 attached [pid 453] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 452] <... clone3 resumed> => {parent_tid=[454]}, 88) = 454 [pid 452] rt_sigprocmask(SIG_SETMASK, [], [pid 453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 452] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 452] <... futex resumed>) = 0 [pid 453] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... mprotect resumed>) = 0 [pid 452] <... futex resumed>) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 452] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [pid 452] <... mprotect resumed>) = 0 [pid 453] <... rt_sigprocmask resumed>[], 8) = 0 [pid 452] rt_sigprocmask(SIG_BLOCK, ~[], [pid 454] set_robust_list(0x7f0c4a20e9a0, 24 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 452] <... rt_sigprocmask resumed>[], 8) = 0 [pid 452] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 453] <... clone3 resumed> => {parent_tid=[455]}, 88) = 455 [pid 453] rt_sigprocmask(SIG_SETMASK, [], [pid 452] <... clone3 resumed> => {parent_tid=[456]}, 88) = 456 [pid 453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_SETMASK, [], [pid 454] <... set_robust_list resumed>) = 0 [pid 453] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 455 attached ) = 0x7f0c4a1cd000 [pid 455] set_robust_list(0x7f0c4a20e9a0, 24 [pid 453] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 455] <... set_robust_list resumed>) = 0 [pid 453] <... mprotect resumed>) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [pid 455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] <... rt_sigprocmask resumed>[], 8) = 0 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[457]}, 88) = 457 [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] memfd_create("syzkaller", 0 [pid 454] rt_sigprocmask(SIG_SETMASK, [], [pid 455] <... memfd_create resumed>) = 3 [pid 454] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 455] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 454] memfd_create("syzkaller", 0./strace-static-x86_64: Process 456 attached ) = 3 [pid 456] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 454] <... mmap resumed>) = 0x7f0c41dcd000 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 457 attached ) = 1 [pid 454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 452] <... futex resumed>) = 0 [pid 444] +++ exited with 0 +++ [pid 442] +++ exited with 0 +++ [pid 441] +++ exited with 0 +++ [pid 440] +++ exited with 0 +++ [pid 299] <... openat resumed>) = 3 [pid 457] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 454] <... write resumed>) = 262144 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] +++ exited with 0 +++ [pid 439] +++ exited with 0 +++ [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=441, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 457] <... set_robust_list resumed>) = 0 [pid 456] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 455] <... write resumed>) = 262144 [pid 454] munmap(0x7f0c41dcd000, 138412032 [pid 452] <... futex resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 457] rt_sigprocmask(SIG_SETMASK, [], [pid 456] <... open resumed>) = 5 [pid 455] munmap(0x7f0c41dcd000, 138412032 [pid 454] <... munmap resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] close(3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=439, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 457] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... munmap resumed>) = 0 [pid 454] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... close resumed>) = 0 [pid 298] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 456] <... futex resumed>) = 0 [pid 455] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 454] <... openat resumed>) = 6 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 457] <... open resumed>) = 4 [pid 456] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 455] <... openat resumed>) = 5 [ 23.808454][ T448] EXT4-fs (loop2): Invalid log block size: 2475723007 [pid 454] ioctl(6, LOOP_SET_FD, 3 [pid 452] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 455] ioctl(5, LOOP_SET_FD, 3 [pid 454] <... ioctl resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 458 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 294] getdents64(3, [pid 457] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 457] <... mount resumed>) = 0 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 453] <... futex resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 457] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] close(3) = 0 [pid 454] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 454] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 458] chdir("./5") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs") = 0 [pid 458] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 458] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 458] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[459]}, 88) = 459 [pid 456] <... futex resumed>) = 0 [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 452] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] newfstatat(AT_FDCWD, "./4/bus", [pid 296] newfstatat(AT_FDCWD, "./4/bus", [pid 294] newfstatat(AT_FDCWD, "./4/bus", [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./4/bus" [pid 296] unlink("./4/bus" [pid 294] unlink("./4/bus" [pid 456] <... write resumed>) = 1045 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 458] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./4/binderfs", [pid 296] newfstatat(AT_FDCWD, "./4/binderfs", [pid 294] newfstatat(AT_FDCWD, "./4/binderfs", [pid 458] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./4/binderfs" [pid 296] unlink("./4/binderfs" [pid 294] unlink("./4/binderfs" [pid 458] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 294] getdents64(3, [pid 458] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 458] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(AT_FDCWD, "./4/file1", [pid 296] close(3 [pid 294] close(3 [pid 458] <... mprotect resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./4" [pid 294] rmdir("./4" [pid 458] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] mkdir("./5", 0777 [pid 294] mkdir("./5", 0777 [pid 457] <... open resumed>) = 6 [pid 455] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 296] <... mkdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 458] <... clone3 resumed> => {parent_tid=[461]}, 88) = 461 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(4, "", [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 458] rt_sigprocmask(SIG_SETMASK, [], [pid 457] <... futex resumed>) = 1 [pid 455] close(3 [pid 453] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 296] ioctl(3, LOOP_CLR_FD [pid 294] ioctl(3, LOOP_CLR_FD [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 458] <... futex resumed>) = 0 [pid 457] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(4, [pid 296] close(3 [pid 294] close(3 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... write resumed>) = 8 [pid 455] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./4/file1" [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 462 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 463 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 457] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 457] <... write resumed>) = 1045 [pid 455] mkdir("./bus", 0777 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] rmdir("./4") = 0 [pid 298] mkdir("./5", 0777) = 0 ./strace-static-x86_64: Process 459 attached [pid 455] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 459] set_robust_list(0x7f0c4a20e9a0, 24 [pid 455] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... openat resumed>) = 3 [pid 459] <... set_robust_list resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 459] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 459] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] close(3 [pid 459] memfd_create("syzkaller", 0 [pid 298] <... close resumed>) = 0 [pid 459] <... memfd_create resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 464 [pid 459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 463 attached [pid 463] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 463] chdir("./5") = 0 [pid 463] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 463] setpgid(0, 0) = 0 [pid 463] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 463] write(3, "1000", 4) = 4 [pid 459] <... write resumed>) = 262144 [pid 463] close(3 [pid 459] munmap(0x7f0c41dcd000, 138412032 [pid 463] <... close resumed>) = 0 [pid 459] <... munmap resumed>) = 0 [pid 463] symlink("/dev/binderfs", "./binderfs" [pid 459] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 463] <... symlink resumed>) = 0 [pid 459] <... openat resumed>) = 4 [pid 463] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 464 attached ./strace-static-x86_64: Process 461 attached [pid 463] <... futex resumed>) = 0 [pid 463] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 461] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] set_robust_list(0x555556d8d6a0, 24 [pid 463] <... rt_sigaction resumed>NULL, 8) = 0 [pid 463] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 462 attached [pid 464] <... set_robust_list resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] <... set_robust_list resumed>) = 0 [pid 463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 463] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 461] rt_sigprocmask(SIG_SETMASK, [], [pid 464] chdir("./5" [pid 463] <... mprotect resumed>) = 0 [pid 463] rt_sigprocmask(SIG_BLOCK, ~[], [pid 461] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] <... chdir resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] set_robust_list(0x555556d8d6a0, 24 [ 23.849994][ T454] loop1: detected capacity change from 0 to 512 [ 23.857551][ T455] loop3: detected capacity change from 0 to 512 [ 23.883270][ T455] EXT4-fs (loop3): Invalid log block size: 2475723007 [ 23.889476][ T459] loop5: detected capacity change from 0 to 512 [pid 463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] <... clone3 resumed> => {parent_tid=[466]}, 88) = 466 [pid 462] <... set_robust_list resumed>) = 0 [pid 461] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 463] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 463] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] <... open resumed>) = 5 [pid 463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 463] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 463] rt_sigprocmask(SIG_BLOCK, ~[], [pid 464] <... prctl resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>[], 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] setpgid(0, 0 [pid 463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 458] <... futex resumed>) = 0 [pid 461] <... futex resumed>) = 1 [pid 464] <... setpgid resumed>) = 0 [pid 462] chdir("./5" [pid 461] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 463] <... clone3 resumed> => {parent_tid=[467]}, 88) = 467 [pid 461] <... mount resumed>) = 0 [pid 458] <... futex resumed>) = 0 [pid 463] rt_sigprocmask(SIG_SETMASK, [], [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... openat resumed>) = 3 [pid 463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... chdir resumed>) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 466 attached [pid 463] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = 0 [pid 466] set_robust_list(0x7f0c4a20e9a0, 24 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 466] <... set_robust_list resumed>) = 0 [pid 466] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 466] memfd_create("syzkaller", 0 [pid 464] write(3, "1000", 4 [pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 466] <... memfd_create resumed>) = 3 [pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 466] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 464] <... write resumed>) = 4 [pid 462] <... prctl resumed>) = 0 [pid 461] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=46000000} [pid 466] <... write resumed>) = 262144 [pid 464] close(3 [pid 462] setpgid(0, 0 [pid 464] <... close resumed>) = 0 [pid 462] <... setpgid resumed>) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs" [pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 466] munmap(0x7f0c41dcd000, 138412032 [pid 464] <... symlink resumed>) = 0 [pid 462] <... openat resumed>) = 3 [pid 466] <... munmap resumed>) = 0 [pid 464] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 464] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 466] <... openat resumed>) = 4 [pid 464] <... rt_sigaction resumed>NULL, 8) = 0 [pid 462] write(3, "1000", 4 [pid 466] ioctl(4, LOOP_SET_FD, 3 [pid 464] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 462] <... write resumed>) = 4 ./strace-static-x86_64: Process 467 attached [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] close(3 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 462] <... close resumed>) = 0 [pid 467] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 462] symlink("/dev/binderfs", "./binderfs" [pid 464] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 462] <... symlink resumed>) = 0 [pid 466] <... ioctl resumed>) = 0 [pid 467] <... set_robust_list resumed>) = 0 [pid 466] close(3 [pid 464] <... mprotect resumed>) = 0 [pid 462] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... open resumed>) = 6 [pid 459] <... ioctl resumed>) = 0 [pid 455] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 464] rt_sigprocmask(SIG_BLOCK, ~[], [pid 462] <... futex resumed>) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], [pid 455] ioctl(5, LOOP_CLR_FD [pid 464] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 462] <... rt_sigaction resumed>NULL, 8) = 0 [pid 461] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 461] <... write resumed>) = 8 [pid 458] <... futex resumed>) = 0 [pid 464] <... clone3 resumed> => {parent_tid=[468]}, 88) = 468 [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] rt_sigprocmask(SIG_SETMASK, [], [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 461] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 461] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 458] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 462] <... mprotect resumed>) = 0 [pid 461] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [pid 461] <... write resumed>) = 1045 [pid 464] <... futex resumed>) = 0 [pid 462] <... rt_sigprocmask resumed>[], 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 464] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 467] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 455] <... ioctl resumed>) = 0 [pid 459] close(3 [pid 466] <... close resumed>) = 0 [pid 467] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 464] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 462] <... clone3 resumed> => {parent_tid=[469]}, 88) = 469 [pid 455] close(5 [pid 459] <... close resumed>) = 0 [pid 466] mkdir("./bus", 0777 [pid 464] <... mprotect resumed>) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], [pid 464] rt_sigprocmask(SIG_BLOCK, ~[], [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 469 attached ./strace-static-x86_64: Process 468 attached [pid 467] <... open resumed>) = 3 [pid 466] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 464] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 462] <... futex resumed>) = 0 [pid 459] mkdir("./bus", 0777 [pid 455] <... close resumed>) = 0 [pid 454] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 468] set_robust_list(0x7f0c4a20e9a0, 24 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 455] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] ioctl(6, LOOP_CLR_FD [pid 468] <... set_robust_list resumed>) = 0 [pid 467] <... futex resumed>) = 1 [pid 464] <... clone3 resumed> => {parent_tid=[470]}, 88) = 470 [pid 463] <... futex resumed>) = 0 [pid 462] <... futex resumed>) = 0 [ 23.901316][ T454] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.925618][ T466] loop0: detected capacity change from 0 to 512 [ 23.933056][ T454] EXT4-fs (loop1): get root inode failed [ 23.938884][ T454] EXT4-fs (loop1): mount failed [pid 459] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 455] <... futex resumed>) = 0 [pid 454] <... ioctl resumed>) = 0 [pid 453] exit_group(0./strace-static-x86_64: Process 470 attached [pid 469] set_robust_list(0x7f0c4a20e9a0, 24 [pid 468] rt_sigprocmask(SIG_SETMASK, [], [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] rt_sigprocmask(SIG_SETMASK, [], [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 457] <... futex resumed>) = ? [pid 453] <... exit_group resumed>) = ? [pid 470] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 457] +++ exited with 0 +++ [pid 470] <... set_robust_list resumed>) = 0 [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 470] rt_sigprocmask(SIG_SETMASK, [], [pid 464] <... futex resumed>) = 0 [pid 462] <... mprotect resumed>) = 0 [pid 470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [pid 470] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 462] <... rt_sigprocmask resumed>[], 8) = 0 [pid 470] <... open resumed>) = 3 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 464] <... futex resumed>) = 0 [pid 462] <... clone3 resumed> => {parent_tid=[471]}, 88) = 471 [pid 470] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_SETMASK, [], [pid 470] <... mount resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 470] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... open resumed>) = 4 [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 470] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 470] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... futex resumed>) = 0 [pid 470] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 463] <... futex resumed>) = 0 [pid 454] close(6 [pid 470] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 467] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 471 attached [pid 471] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 471] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 468] memfd_create("syzkaller", 0 [pid 467] <... mount resumed>) = 0 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... close resumed>) = 0 [pid 469] <... set_robust_list resumed>) = 0 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... memfd_create resumed>) = 5 [pid 463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 454] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 469] rt_sigprocmask(SIG_SETMASK, [], [pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 467] <... futex resumed>) = 0 [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 454] <... futex resumed>) = 0 [pid 471] <... open resumed>) = 3 [pid 469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 468] <... mmap resumed>) = 0x7f0c41dcd000 [pid 467] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 463] <... futex resumed>) = 0 [pid 454] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] exit_group(0 [pid 471] <... futex resumed>) = 1 [pid 462] <... futex resumed>) = 0 [pid 456] <... futex resumed>) = ? [pid 452] <... exit_group resumed>) = ? [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] +++ exited with 0 +++ [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... mount resumed>) = 0 [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 471] <... open resumed>) = 4 [pid 467] <... open resumed>) = 5 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... futex resumed>) = ? [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 463] <... futex resumed>) = 0 [pid 459] ioctl(4, LOOP_CLR_FD) = 0 [pid 459] close(4) = 0 [pid 459] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 459] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] memfd_create("syzkaller", 0) = 5 [pid 469] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 469] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 458] exit_group(0 [pid 469] <... write resumed>) = 262144 [pid 461] <... futex resumed>) = ? [pid 459] <... futex resumed>) = ? [pid 458] <... exit_group resumed>) = ? [pid 469] munmap(0x7f0c41dcd000, 138412032 [pid 461] +++ exited with 0 +++ [pid 459] +++ exited with 0 +++ [pid 469] <... munmap resumed>) = 0 [pid 469] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 467] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... write resumed>) = 262144 [pid 463] <... futex resumed>) = 0 [pid 469] <... openat resumed>) = 6 [pid 467] <... write resumed>) = 8 [pid 468] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 468] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 6 [pid 468] ioctl(6, LOOP_SET_FD, 5 [pid 469] ioctl(6, LOOP_SET_FD, 5 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 299] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 468] <... ioctl resumed>) = 0 [pid 468] close(5) = 0 [pid 468] mkdir("./file1", 0777) = 0 [ 23.952603][ T459] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 23.967619][ T466] EXT4-fs (loop0): 1 orphan inode deleted [ 23.974677][ T466] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.977193][ T468] loop4: detected capacity change from 0 to 512 [ 23.985912][ T466] ext4 filesystem being mounted at /root/syzkaller.iF59aB/5/bus supports timestamps until 2038 (0x7fffffff) [pid 468] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 467] <... futex resumed>) = 0 [pid 463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... umount2 resumed>) = 0 [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] +++ exited with 0 +++ [pid 454] +++ exited with 0 +++ [pid 453] +++ exited with 0 +++ [pid 452] +++ exited with 0 +++ [pid 467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 463] <... futex resumed>) = 0 [pid 467] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... write resumed>) = 1045 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 463] <... futex resumed>) = 0 [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] <... ioctl resumed>) = 0 [pid 469] close(5) = 0 [pid 469] mkdir("./file1", 0777) = 0 [pid 469] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=453, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 466] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 466] ioctl(4, LOOP_CLR_FD) = 0 [pid 466] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 466] <... close resumed>) = 0 [pid 466] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 463] exit_group(0 [pid 299] newfstatat(AT_FDCWD, "./5/bus", [pid 467] <... futex resumed>) = ? [pid 466] <... futex resumed>) = ? [pid 463] <... exit_group resumed>) = ? [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 467] +++ exited with 0 +++ [pid 466] +++ exited with 0 +++ [pid 299] unlink("./5/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 299] newfstatat(AT_FDCWD, "./5/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] newfstatat(3, "", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./5/binderfs" [pid 297] getdents64(3, [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] getdents64(3, [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] close(3 [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 299] rmdir("./5" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... rmdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./5/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] mkdir("./6", 0777 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./4/bus", [pid 299] <... mkdir resumed>) = 0 [pid 297] unlink("./5/bus" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... unlink resumed>) = 0 [pid 295] unlink("./4/bus" [pid 299] <... openat resumed>) = 3 [pid 297] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] newfstatat(AT_FDCWD, "./5/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./4/binderfs", [pid 299] <... close resumed>) = 0 [pid 297] unlink("./5/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... unlink resumed>) = 0 [ 24.003169][ T469] loop2: detected capacity change from 0 to 512 [ 24.028398][ T468] EXT4-fs (loop4): 1 orphan inode deleted [ 24.034222][ T468] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.036801][ T469] EXT4-fs (loop2): 1 orphan inode deleted [pid 295] unlink("./4/binderfs"./strace-static-x86_64: Process 478 attached [pid 468] <... mount resumed>) = 0 [pid 297] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 478] set_robust_list(0x555556d8d6a0, 24 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 478 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 478] <... set_robust_list resumed>) = 0 [pid 297] close(3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 478] chdir("./6" [pid 297] <... close resumed>) = 0 [pid 295] close(3 [pid 478] <... chdir resumed>) = 0 [pid 297] rmdir("./5" [pid 295] <... close resumed>) = 0 [pid 478] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] <... rmdir resumed>) = 0 [pid 295] rmdir("./4" [pid 478] <... prctl resumed>) = 0 [pid 297] mkdir("./6", 0777 [pid 295] <... rmdir resumed>) = 0 [pid 478] setpgid(0, 0 [pid 297] <... mkdir resumed>) = 0 [pid 295] mkdir("./5", 0777 [pid 478] <... setpgid resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... mkdir resumed>) = 0 [pid 478] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 478] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] <... openat resumed>) = 3 [pid 478] write(3, "1000", 4 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] ioctl(3, LOOP_CLR_FD [pid 478] <... write resumed>) = 4 [pid 297] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 478] close(3 [pid 297] <... close resumed>) = 0 [pid 295] close(3 [pid 478] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... close resumed>) = 0 [pid 478] symlink("/dev/binderfs", "./binderfs" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 478] <... symlink resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 479 [pid 478] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 480 [pid 478] <... futex resumed>) = 0 [pid 478] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 478] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 478] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 478] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 478] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[481]}, 88) = 481 [pid 478] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 478] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 478] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 478] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 478] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[482]}, 88) = 482 [pid 478] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 482 attached ./strace-static-x86_64: Process 481 attached ./strace-static-x86_64: Process 480 attached ./strace-static-x86_64: Process 479 attached NULL, 8) = 0 [pid 469] <... mount resumed>) = 0 [pid 468] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 463] +++ exited with 0 +++ [pid 481] set_robust_list(0x7f0c4a20e9a0, 24 [pid 480] set_robust_list(0x555556d8d6a0, 24 [pid 479] set_robust_list(0x555556d8d6a0, 24 [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 468] <... openat resumed>) = 5 [pid 481] <... set_robust_list resumed>) = 0 [pid 480] <... set_robust_list resumed>) = 0 [pid 479] <... set_robust_list resumed>) = 0 [pid 469] <... openat resumed>) = 5 [pid 468] chdir("./file1" [pid 481] rt_sigprocmask(SIG_SETMASK, [], [pid 480] chdir("./5" [pid 479] chdir("./6" [pid 469] chdir("./file1" [pid 468] <... chdir resumed>) = 0 [pid 481] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 480] <... chdir resumed>) = 0 [pid 479] <... chdir resumed>) = 0 [pid 469] <... chdir resumed>) = 0 [pid 468] ioctl(6, LOOP_CLR_FD [pid 482] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 481] memfd_create("syzkaller", 0 [pid 480] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 478] <... futex resumed>) = 0 [pid 469] ioctl(6, LOOP_CLR_FD [pid 468] <... ioctl resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=463, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 482] <... set_robust_list resumed>) = 0 [pid 481] <... memfd_create resumed>) = 3 [pid 480] <... prctl resumed>) = 0 [pid 479] <... prctl resumed>) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... ioctl resumed>) = 0 [pid 468] close(6 [pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 480] setpgid(0, 0 [pid 479] setpgid(0, 0 [pid 469] close(6 [pid 468] <... close resumed>) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], [pid 481] <... mmap resumed>) = 0x7f0c41dcd000 [pid 480] <... setpgid resumed>) = 0 [pid 479] <... setpgid resumed>) = 0 [pid 469] <... close resumed>) = 0 [pid 468] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 481] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 480] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 469] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... futex resumed>) = 0 [pid 482] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 481] <... write resumed>) = 262144 [pid 480] <... openat resumed>) = 3 [pid 479] <... openat resumed>) = 3 [pid 469] <... futex resumed>) = 0 [pid 468] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... open resumed>) = 4 [pid 481] munmap(0x7f0c41dcd000, 138412032 [pid 480] write(3, "1000", 4 [pid 479] write(3, "1000", 4 [pid 469] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] exit_group(0 [pid 462] exit_group(0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 481] <... munmap resumed>) = 0 [pid 480] <... write resumed>) = 4 [pid 479] <... write resumed>) = 4 [pid 471] <... futex resumed>) = ? [pid 470] <... futex resumed>) = ? [pid 469] <... futex resumed>) = ? [pid 468] <... futex resumed>) = ? [pid 464] <... exit_group resumed>) = ? [pid 462] <... exit_group resumed>) = ? [pid 294] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 482] <... futex resumed>) = 1 [pid 481] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 480] close(3 [pid 479] close(3 [pid 478] <... futex resumed>) = 0 [pid 471] +++ exited with 0 +++ [pid 470] +++ exited with 0 +++ [pid 469] +++ exited with 0 +++ [pid 468] +++ exited with 0 +++ [pid 481] <... openat resumed>) = 5 [pid 480] <... close resumed>) = 0 [ 24.045999][ T468] ext4 filesystem being mounted at /root/syzkaller.qPQybd/5/file1 supports timestamps until 2038 (0x7fffffff) [ 24.051245][ T469] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.075153][ T469] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/5/file1 supports timestamps until 2038 (0x7fffffff) [pid 479] <... close resumed>) = 0 [pid 464] +++ exited with 0 +++ [pid 481] ioctl(5, LOOP_SET_FD, 3 [pid 482] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 480] symlink("/dev/binderfs", "./binderfs" [pid 479] symlink("/dev/binderfs", "./binderfs" [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 482] <... mount resumed>) = 0 [pid 481] <... ioctl resumed>) = 0 [pid 480] <... symlink resumed>) = 0 [pid 479] <... symlink resumed>) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=462, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] newfstatat(3, "", [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... futex resumed>) = 0 [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 479] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... rt_sigaction resumed>NULL, 8) = 0 [pid 479] <... rt_sigaction resumed>NULL, 8) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 480] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 479] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 482] <... open resumed>) = 6 [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 482] <... futex resumed>) = 1 [pid 480] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 479] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 478] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 294] <... umount2 resumed>) = 0 [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 479] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... mprotect resumed>) = 0 [pid 479] <... mprotect resumed>) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 480] rt_sigprocmask(SIG_BLOCK, ~[], [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... rt_sigprocmask resumed>[], 8) = 0 [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] newfstatat(AT_FDCWD, "./5/bus", [pid 480] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 482] <... write resumed>) = 8 [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... clone3 resumed> => {parent_tid=[483]}, 88) = 483 [pid 479] <... clone3 resumed> => {parent_tid=[484]}, 88) = 484 [pid 298] <... umount2 resumed>) = 0 [pid 482] <... futex resumed>) = 1 [pid 480] rt_sigprocmask(SIG_SETMASK, [], [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 294] unlink("./5/bus" [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] <... futex resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] newfstatat(AT_FDCWD, "./5/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] newfstatat(AT_FDCWD, "./5/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 298] unlink("./5/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] <... write resumed>) = 1045 [pid 480] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] newfstatat(AT_FDCWD, "./5/binderfs", [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 479] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... unlink resumed>) = 0 [pid 296] unlink("./5/bus" [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] <... futex resumed>) = 1 [pid 480] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 479] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] <... mprotect resumed>) = 0 [pid 479] <... mprotect resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] unlink("./5/binderfs" [pid 480] rt_sigprocmask(SIG_BLOCK, ~[], [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(AT_FDCWD, "./5/binderfs", [pid 296] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] <... rt_sigprocmask resumed>[], 8) = 0 [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... unlink resumed>) = 0 [pid 480] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] unlink("./5/binderfs" [pid 296] newfstatat(AT_FDCWD, "./5/binderfs", [pid 294] getdents64(3, [pid 480] <... clone3 resumed> => {parent_tid=[485]}, 88) = 485 [pid 479] <... clone3 resumed> => {parent_tid=[486]}, 88) = 486 [pid 480] rt_sigprocmask(SIG_SETMASK, [], [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./5/binderfs" [pid 294] close(3 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 481] close(3) = 0 [pid 481] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 481] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 483 attached [pid 483] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 483] memfd_create("syzkaller", 0) = 3 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 296] <... unlink resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 294] rmdir("./5" [pid 483] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 294] <... rmdir resumed>) = 0 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] mkdir("./6", 0777 [pid 483] <... write resumed>) = 262144 [pid 483] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 483] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] <... mkdir resumed>) = 0 [pid 483] <... openat resumed>) = 4 [pid 483] ioctl(4, LOOP_SET_FD, 3 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 483] <... ioctl resumed>) = 0 [pid 483] close(3) = 0 [pid 483] mkdir("./file1", 0777) = 0 [pid 483] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 484 attached [pid 484] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 484] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 484] memfd_create("syzkaller", 0) = 3 [pid 484] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 484] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 484] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 484] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 484] ioctl(4, LOOP_SET_FD, 3 [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 485] <... set_robust_list resumed>) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 294] close(3) = 0 [pid 485] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 485] <... open resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 488 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 481] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 481] ioctl(5, LOOP_CLR_FD) = 0 [pid 296] <... openat resumed>) = 4 [pid 296] newfstatat(4, "", [pid 481] close(5 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 481] <... close resumed>) = 0 [pid 296] getdents64(4, [pid 485] <... write resumed>) = 1045 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 480] <... futex resumed>) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 481] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(4 [pid 485] <... futex resumed>) = 1 [pid 296] <... close resumed>) = 0 [pid 481] <... futex resumed>) = 0 [pid 296] rmdir("./5/file1" [pid 485] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... rmdir resumed>) = 0 [pid 478] exit_group(0 [pid 296] getdents64(3, [pid 482] <... futex resumed>) = ? [pid 478] <... exit_group resumed>) = ? [pid 482] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 481] <... futex resumed>) = ? [ 24.110694][ T481] loop5: detected capacity change from 0 to 512 [ 24.131857][ T483] loop1: detected capacity change from 0 to 512 [ 24.138215][ T481] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 24.143263][ T484] loop3: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 488 attached ./strace-static-x86_64: Process 486 attached [pid 484] <... ioctl resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./5") = 0 [pid 296] mkdir("./6", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 486] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 486] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 486] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 488] chdir("./6") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 488] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 488] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[490]}, 88) = 490 [pid 479] <... futex resumed>) = 0 ./strace-static-x86_64: Process 490 attached [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 484] close(3 [pid 488] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 484] <... close resumed>) = 0 [pid 484] mkdir("./bus", 0777 [pid 488] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 484] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 488] <... mprotect resumed>) = 0 [pid 484] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[491]}, 88) = 491 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] set_robust_list(0x7f0c4a20e9a0, 24 [pid 486] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 1 [pid 490] <... set_robust_list resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 491 attached [pid 490] rt_sigprocmask(SIG_SETMASK, [], [pid 486] <... mount resumed>) = 0 [pid 491] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 488] <... futex resumed>) = 0 [pid 491] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... mount resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... open resumed>) = 4 [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 490] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 490] memfd_create("syzkaller", 0 [pid 488] <... futex resumed>) = 0 [pid 486] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... memfd_create resumed>) = 5 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 483] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 490] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 486] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 483] ioctl(4, LOOP_CLR_FD [pid 479] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 490] <... mmap resumed>) = 0x7f0c41dcd000 [pid 486] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 483] <... ioctl resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... open resumed>) = 3 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 483] close(4) = 0 [pid 483] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 483] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 483] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] exit_group(0 [pid 483] <... futex resumed>) = ? [pid 480] <... exit_group resumed>) = ? [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... write resumed>) = 262144 [pid 485] <... futex resumed>) = ? [pid 483] +++ exited with 0 +++ [pid 479] <... futex resumed>) = 1 [pid 490] munmap(0x7f0c41dcd000, 138412032 [pid 486] <... futex resumed>) = 0 [pid 486] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 490] <... munmap resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 486] <... write resumed>) = 8 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... openat resumed>) = 6 [pid 486] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 490] ioctl(6, LOOP_SET_FD, 5 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 1 [pid 486] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... write resumed>) = 1045 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 479] <... futex resumed>) = 0 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 490] <... ioctl resumed>) = 0 [pid 481] +++ exited with 0 +++ [pid 478] +++ exited with 0 +++ [pid 490] close(5 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=478, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 490] <... close resumed>) = 0 [pid 490] mkdir("./file1", 0777) = 0 [pid 299] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 490] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 24.158956][ T483] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.172566][ T483] EXT4-fs (loop1): get root inode failed [ 24.179359][ T483] EXT4-fs (loop1): mount failed [ 24.191960][ T490] loop0: detected capacity change from 0 to 512 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 299] unlink("./6/bus" [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] newfstatat(AT_FDCWD, "./5/file1", [pid 296] close(3 [pid 299] <... unlink resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... close resumed>) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 494 [pid 298] <... openat resumed>) = 4 [pid 298] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./5/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./5") = 0 [pid 298] mkdir("./6", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 495 [pid 299] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./6/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./6") = 0 [pid 299] mkdir("./7", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 496 ./strace-static-x86_64: Process 494 attached [pid 494] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 494] chdir("./6") = 0 [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 494] setpgid(0, 0) = 0 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 494] write(3, "1000", 4) = 4 [pid 494] close(3) = 0 [pid 494] symlink("/dev/binderfs", "./binderfs") = 0 [pid 494] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 495 attached [pid 494] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 494] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 496 attached [pid 495] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 495] chdir("./6" [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 495] <... chdir resumed>) = 0 [pid 494] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 494] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 495] setpgid(0, 0) = 0 [pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 495] write(3, "1000", 4) = 4 [pid 495] close(3) = 0 [pid 495] symlink("/dev/binderfs", "./binderfs") = 0 [pid 495] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 495] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 495] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [pid 496] set_robust_list(0x555556d8d6a0, 24 [pid 494] <... rt_sigprocmask resumed>[], 8) = 0 [pid 496] <... set_robust_list resumed>) = 0 [pid 496] chdir("./7" [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 496] <... chdir resumed>) = 0 [pid 496] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 494] <... clone3 resumed> => {parent_tid=[500]}, 88) = 500 [pid 496] <... prctl resumed>) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 496] setpgid(0, 0 [pid 495] <... mprotect resumed>) = 0 [pid 495] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 495] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[501]}, 88) = 501 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 495] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 495] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 495] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[502]}, 88) = 502 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 502 attached [pid 502] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 502] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 502] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 494] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] +++ exited with 0 +++ [pid 480] +++ exited with 0 +++ ./strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x7f0c4a20e9a0, 24 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... set_robust_list resumed>) = 0 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 501] rt_sigprocmask(SIG_SETMASK, [], [pid 502] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] memfd_create("syzkaller", 0 [pid 502] <... futex resumed>) = 1 [pid 495] <... futex resumed>) = 0 [pid 502] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 501] <... memfd_create resumed>) = 5 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 495] <... futex resumed>) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... mmap resumed>) = 0x7f0c41dcd000 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 0 [pid 501] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 500] <... futex resumed>) = 0 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 1 [pid 496] <... setpgid resumed>) = 0 [pid 502] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] memfd_create("syzkaller", 0 [pid 496] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... memfd_create resumed>) = 3 [pid 496] <... openat resumed>) = 3 [pid 494] <... futex resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=480, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 500] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 496] write(3, "1000", 4 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 500] <... mmap resumed>) = 0x7f0c41dee000 [ 24.194263][ T484] EXT4-fs error (device loop3): ext4_map_blocks:602: inode #3: block 9: comm syz-executor170: lblock 0 mapped to illegal pblock 9 (length 1) [ 24.214915][ T484] EXT4-fs warning (device loop3): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 24.232876][ T490] EXT4-fs (loop0): 1 orphan inode deleted [ 24.240578][ T490] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 496] <... write resumed>) = 4 [pid 494] <... mmap resumed>) = 0x7f0c41dcd000 [pid 295] <... restart_syscall resumed>) = 0 [pid 501] <... write resumed>) = 262144 [pid 500] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 501] munmap(0x7f0c41dcd000, 138412032 [pid 500] <... write resumed>) = 262144 [pid 501] <... munmap resumed>) = 0 [pid 500] munmap(0x7f0c41dee000, 138412032 [pid 501] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 500] <... munmap resumed>) = 0 [pid 501] <... openat resumed>) = 6 [pid 500] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 501] ioctl(6, LOOP_SET_FD, 5 [pid 500] <... openat resumed>) = 4 [pid 500] ioctl(4, LOOP_SET_FD, 3 [pid 496] close(3 [pid 494] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 501] <... ioctl resumed>) = 0 [pid 496] <... close resumed>) = 0 [pid 494] <... mprotect resumed>) = 0 [pid 501] close(5 [pid 496] symlink("/dev/binderfs", "./binderfs" [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 501] <... close resumed>) = 0 [pid 496] <... symlink resumed>) = 0 [pid 494] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 501] mkdir("./file1", 0777 [pid 496] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 295] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 501] <... mkdir resumed>) = 0 [pid 496] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 501] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 496] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 494] <... clone3 resumed> => {parent_tid=[503]}, 88) = 503 [pid 295] newfstatat(3, "", [pid 496] <... rt_sigaction resumed>NULL, 8) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 496] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] getdents64(3, [pid 496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 494] <... futex resumed>) = 0 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 496] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 496] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[504]}, 88) = 504 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 496] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[505]}, 88) = 505 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 505 attached ./strace-static-x86_64: Process 504 attached ./strace-static-x86_64: Process 503 attached [pid 500] <... ioctl resumed>) = 0 [pid 490] <... mount resumed>) = 0 [pid 484] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 295] <... umount2 resumed>) = 0 [pid 505] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 504] set_robust_list(0x7f0c4a20e9a0, 24 [pid 503] set_robust_list(0x7f0c41ded9a0, 24 [pid 500] close(3 [pid 490] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 484] ioctl(4, LOOP_CLR_FD [pid 505] <... set_robust_list resumed>) = 0 [pid 503] <... set_robust_list resumed>) = 0 [pid 500] <... close resumed>) = 0 [pid 490] <... openat resumed>) = 5 [pid 484] <... ioctl resumed>) = 0 [pid 505] rt_sigprocmask(SIG_SETMASK, [], [pid 504] <... set_robust_list resumed>) = 0 [pid 503] rt_sigprocmask(SIG_SETMASK, [], [pid 500] mkdir("./file1", 0777 [pid 490] chdir("./file1" [pid 484] close(4 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 504] rt_sigprocmask(SIG_SETMASK, [], [pid 503] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 484] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 504] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] newfstatat(AT_FDCWD, "./5/bus", [pid 504] memfd_create("syzkaller", 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 504] <... memfd_create resumed>) = 3 [pid 295] unlink("./5/bus" [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 295] <... unlink resumed>) = 0 [pid 504] <... mmap resumed>) = 0x7f0c41dcd000 [pid 295] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 503] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 500] <... mkdir resumed>) = 0 [pid 490] <... chdir resumed>) = 0 [pid 484] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... open resumed>) = 4 [pid 503] <... open resumed>) = 3 [pid 500] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 490] ioctl(6, LOOP_CLR_FD [pid 484] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 504] <... write resumed>) = 262144 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./5/binderfs", [pid 504] munmap(0x7f0c41dcd000, 138412032 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] <... futex resumed>) = 1 [pid 504] <... munmap resumed>) = 0 [pid 503] <... futex resumed>) = 1 [pid 484] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] unlink("./5/binderfs" [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 504] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 490] <... ioctl resumed>) = 0 [pid 479] exit_group(0 [pid 295] <... unlink resumed>) = 0 [pid 504] <... openat resumed>) = 5 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] close(6 [pid 486] <... futex resumed>) = ? [pid 484] <... futex resumed>) = ? [pid 479] <... exit_group resumed>) = ? [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... futex resumed>) = 0 [pid 504] ioctl(5, LOOP_SET_FD, 3 [pid 503] <... futex resumed>) = 0 [pid 496] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 1 [pid 490] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 503] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] +++ exited with 0 +++ [pid 484] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./5/file1", [pid 505] <... mount resumed>) = 0 [pid 503] <... mount resumed>) = 0 [pid 490] <... futex resumed>) = 0 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 503] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 503] <... open resumed>) = 5 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] exit_group(0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... futex resumed>) = 1 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 491] <... futex resumed>) = ? [pid 490] <... futex resumed>) = ? [pid 488] <... exit_group resumed>) = ? [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] +++ exited with 0 +++ [pid 295] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 496] <... futex resumed>) = 0 [pid 490] +++ exited with 0 +++ [pid 488] +++ exited with 0 +++ [pid 505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... openat resumed>) = 4 [pid 505] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 503] <... write resumed>) = 8 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(4, "", [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [ 24.279030][ T484] EXT4-fs (loop3): mount failed [ 24.284852][ T501] loop4: detected capacity change from 0 to 512 [ 24.288734][ T490] ext4 filesystem being mounted at /root/syzkaller.iF59aB/6/file1 supports timestamps until 2038 (0x7fffffff) [ 24.291678][ T500] loop2: detected capacity change from 0 to 512 [ 24.322566][ T504] loop5: detected capacity change from 0 to 512 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 503] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 503] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 504] <... ioctl resumed>) = 0 [pid 504] close(3) = 0 [pid 504] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 504] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 295] getdents64(4, [pid 294] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... open resumed>) = 6 [pid 503] <... write resumed>) = 1045 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] <... futex resumed>) = 1 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 295] getdents64(4, [pid 294] newfstatat(AT_FDCWD, "./6/bus", [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... futex resumed>) = 1 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... futex resumed>) = 0 [pid 505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] close(4) = 0 [pid 295] rmdir("./5/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./5") = 0 [pid 295] mkdir("./6", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 510 [pid 294] unlink("./6/bus") = 0 [pid 294] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./6/binderfs") = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 510 attached [pid 505] <... write resumed>) = 8 [ 24.336032][ T501] EXT4-fs (loop4): 1 orphan inode deleted [ 24.343554][ T501] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.354059][ T500] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.357373][ T504] EXT4-fs (loop5): 1 orphan inode deleted [ 24.369127][ T501] ext4 filesystem being mounted at /root/syzkaller.qPQybd/6/file1 supports timestamps until 2038 (0x7fffffff) [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] +++ exited with 0 +++ [pid 505] <... futex resumed>) = 1 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 496] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 505] <... write resumed>) = 1045 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] set_robust_list(0x555556d8d6a0, 24 [pid 297] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] <... futex resumed>) = 0 [pid 510] <... set_robust_list resumed>) = 0 [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 510] chdir("./6" [pid 297] newfstatat(3, "", [pid 510] <... chdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 510] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] getdents64(3, [pid 510] <... prctl resumed>) = 0 [pid 510] setpgid(0, 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 510] <... setpgid resumed>) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] newfstatat(AT_FDCWD, "./6/bus", [pid 510] <... openat resumed>) = 3 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] write(3, "1000", 4 [pid 297] unlink("./6/bus" [pid 510] <... write resumed>) = 4 [pid 510] close(3 [pid 297] <... unlink resumed>) = 0 [pid 501] <... mount resumed>) = 0 [pid 501] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 501] chdir("./file1") = 0 [pid 501] ioctl(6, LOOP_CLR_FD) = 0 [pid 501] close(6) = 0 [pid 501] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 501] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] <... close resumed>) = 0 [pid 495] exit_group(0 [pid 297] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 510] symlink("/dev/binderfs", "./binderfs" [pid 495] <... exit_group resumed>) = ? [pid 297] newfstatat(AT_FDCWD, "./6/binderfs", [pid 510] <... symlink resumed>) = 0 [pid 502] <... futex resumed>) = ? [pid 500] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 510] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] +++ exited with 0 +++ [pid 500] ioctl(4, LOOP_CLR_FD [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 500] <... ioctl resumed>) = 0 [pid 500] close(4) = 0 [pid 500] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 501] <... futex resumed>) = ? [pid 501] +++ exited with 0 +++ [pid 495] +++ exited with 0 +++ [pid 510] <... futex resumed>) = 0 [pid 297] unlink("./6/binderfs" [pid 510] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=495, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] <... unlink resumed>) = 0 [pid 510] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 297] getdents64(3, [pid 510] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 494] exit_group(0 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 494] <... exit_group resumed>) = ? [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 503] <... futex resumed>) = ? [pid 500] <... futex resumed>) = ? [pid 297] close(3 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 503] +++ exited with 0 +++ [pid 297] <... close resumed>) = 0 [pid 510] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./6" [pid 510] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... rmdir resumed>) = 0 [pid 510] <... mprotect resumed>) = 0 [pid 298] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] mkdir("./7", 0777 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... openat resumed>) = 3 [pid 297] <... mkdir resumed>) = 0 [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] newfstatat(3, "", [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, [pid 297] <... openat resumed>) = 3 [pid 510] <... clone3 resumed> => {parent_tid=[513]}, 88) = 513 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 510] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] ioctl(3, LOOP_CLR_FD [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 510] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 510] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./6/bus", [pid 297] close(3 [pid 510] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... close resumed>) = 0 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] unlink("./6/bus" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 510] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 510] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 514 [pid 510] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(AT_FDCWD, "./6/binderfs", [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] unlink("./6/binderfs") = 0 [pid 510] <... clone3 resumed> => {parent_tid=[515]}, 88) = 515 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./6/file1") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3./strace-static-x86_64: Process 515 attached ./strace-static-x86_64: Process 514 attached ./strace-static-x86_64: Process 513 attached [pid 504] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 294] <... close resumed>) = 0 [pid 514] set_robust_list(0x555556d8d6a0, 24 [pid 513] set_robust_list(0x7f0c4a20e9a0, 24 [pid 504] ioctl(5, LOOP_CLR_FD [pid 294] rmdir("./6" [pid 515] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 514] <... set_robust_list resumed>) = 0 [pid 513] <... set_robust_list resumed>) = 0 [pid 504] <... ioctl resumed>) = 0 [pid 500] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ [pid 294] <... rmdir resumed>) = 0 [pid 515] <... set_robust_list resumed>) = 0 [pid 514] chdir("./7" [pid 513] rt_sigprocmask(SIG_SETMASK, [], [pid 504] close(5 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=494, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] mkdir("./7", 0777 [pid 515] rt_sigprocmask(SIG_SETMASK, [], [pid 514] <... chdir resumed>) = 0 [pid 513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 504] <... close resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 515] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 513] memfd_create("syzkaller", 0 [pid 504] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 515] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 514] <... prctl resumed>) = 0 [pid 513] <... memfd_create resumed>) = 3 [pid 504] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 515] <... open resumed>) = 4 [pid 514] setpgid(0, 0 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 504] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] ioctl(3, LOOP_CLR_FD [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... setpgid resumed>) = 0 [pid 513] <... mmap resumed>) = 0x7f0c41dcd000 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 515] <... futex resumed>) = 1 [pid 514] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 510] <... futex resumed>) = 0 [pid 496] exit_group(0 [pid 294] close(3 [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... openat resumed>) = 3 [pid 513] <... write resumed>) = 262144 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = ? [pid 504] <... futex resumed>) = ? [pid 496] <... exit_group resumed>) = ? [pid 294] <... close resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] write(3, "1000", 4 [pid 513] munmap(0x7f0c41dcd000, 138412032 [pid 510] <... futex resumed>) = 0 [pid 505] +++ exited with 0 +++ [pid 504] +++ exited with 0 +++ [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 515] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 514] <... write resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 516 attached [pid 515] <... mount resumed>) = 0 [pid 514] close(3 [pid 513] <... munmap resumed>) = 0 [pid 296] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 516] set_robust_list(0x555556d8d6a0, 24 [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... close resumed>) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] <... openat resumed>) = 3 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 516 [pid 516] <... set_robust_list resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 514] symlink("/dev/binderfs", "./binderfs" [pid 513] <... openat resumed>) = 5 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 516] chdir("./7" [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... symlink resumed>) = 0 [pid 513] ioctl(5, LOOP_SET_FD, 3 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 516] <... chdir resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [ 24.385018][ T500] EXT4-fs (loop2): get root inode failed [ 24.392735][ T500] EXT4-fs (loop2): mount failed [ 24.398987][ T504] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.411308][ T504] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/7/bus supports timestamps until 2038 (0x7fffffff) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 516] setpgid(0, 0) = 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 516] write(3, "1000", 4) = 4 [pid 516] close(3) = 0 [pid 516] symlink("/dev/binderfs", "./binderfs") = 0 [pid 516] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 516] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 296] <... umount2 resumed>) = 0 [pid 515] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 514] <... futex resumed>) = 0 [pid 513] <... ioctl resumed>) = 0 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 515] <... open resumed>) = 6 [pid 514] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 513] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... rt_sigaction resumed>NULL, 8) = 0 [pid 513] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/bus", [pid 515] <... futex resumed>) = 1 [pid 514] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 510] <... futex resumed>) = 0 [pid 516] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] mkdir("./bus", 0777 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 516] <... mprotect resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 510] <... futex resumed>) = 0 [pid 296] unlink("./6/bus" [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 515] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 514] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 513] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 514] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 513] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... unlink resumed>) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 515] <... write resumed>) = 8 [pid 514] <... mprotect resumed>) = 0 [pid 296] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 517 attached [pid 516] <... clone3 resumed> => {parent_tid=[517]}, 88) = 517 [pid 515] <... futex resumed>) = 1 [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/binderfs", [pid 517] set_robust_list(0x7f0c4a20e9a0, 24 [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 517] <... set_robust_list resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 510] <... futex resumed>) = 0 [pid 296] unlink("./6/binderfs"./strace-static-x86_64: Process 518 attached [pid 517] rt_sigprocmask(SIG_SETMASK, [], [pid 516] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 514] <... clone3 resumed> => {parent_tid=[518]}, 88) = 518 [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 518] set_robust_list(0x7f0c4a20e9a0, 24 [pid 517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 516] <... futex resumed>) = 0 [pid 515] <... write resumed>) = 1045 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 518] <... set_robust_list resumed>) = 0 [pid 517] memfd_create("syzkaller", 0 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 518] rt_sigprocmask(SIG_SETMASK, [], [pid 517] <... memfd_create resumed>) = 3 [pid 516] <... futex resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 514] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/file1", [pid 518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 518] memfd_create("syzkaller", 0 [pid 517] <... mmap resumed>) = 0x7f0c41dee000 [pid 516] <... mmap resumed>) = 0x7f0c41dcd000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 518] <... memfd_create resumed>) = 3 [pid 517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 516] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 514] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 518] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 517] <... write resumed>) = 262144 [pid 516] <... mprotect resumed>) = 0 [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 518] <... mmap resumed>) = 0x7f0c41dee000 [pid 517] munmap(0x7f0c41dee000, 138412032 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 514] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... openat resumed>) = 4 [pid 296] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./6/file1") = 0 [pid 296] getdents64(3, [pid 517] <... munmap resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 514] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 517] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 514] <... mprotect resumed>) = 0 [pid 296] close(3 [pid 518] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 517] <... openat resumed>) = 4 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... close resumed>) = 0 [pid 517] ioctl(4, LOOP_SET_FD, 3 [pid 516] <... clone3 resumed> => {parent_tid=[521]}, 88) = 521 [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] rmdir("./6"./strace-static-x86_64: Process 521 attached [pid 518] <... write resumed>) = 262144 [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 496] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 521] set_robust_list(0x7f0c41ded9a0, 24 [pid 518] munmap(0x7f0c41dee000, 138412032 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 521] <... set_robust_list resumed>) = 0 [pid 518] <... munmap resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 521] rt_sigprocmask(SIG_SETMASK, [], [pid 518] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] newfstatat(AT_FDCWD, "./6/file1", [pid 521] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 518] <... openat resumed>) = 4 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] mkdir("./7", 0777 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 24.452726][ T513] loop1: detected capacity change from 0 to 512 [ 24.469212][ T513] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.483947][ T513] EXT4-fs (loop1): get root inode failed [ 24.485843][ T517] loop0: detected capacity change from 0 to 512 [ 24.492909][ T513] EXT4-fs (loop1): mount failed [pid 518] ioctl(4, LOOP_SET_FD, 3 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 517] <... ioctl resumed>) = 0 [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... clone3 resumed> => {parent_tid=[522]}, 88) = 522 [pid 513] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=496, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... mkdir resumed>) = 0 [pid 518] <... ioctl resumed>) = 0 [pid 513] ioctl(5, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 518] close(3 [pid 513] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 521] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = 1 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 521] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 518] <... close resumed>) = 0 [pid 513] close(5 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 298] newfstatat(4, "", [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 521] <... open resumed>) = 5 [pid 518] mkdir("./file1", 0777 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 522 attached [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... mkdir resumed>) = 0 [pid 517] close(3 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... restart_syscall resumed>) = 0 [pid 298] getdents64(4, [pid 296] <... openat resumed>) = 3 [pid 522] set_robust_list(0x7f0c41ded9a0, 24 [pid 521] <... futex resumed>) = 0 [pid 518] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 513] <... futex resumed>) = 0 [pid 517] <... close resumed>) = 0 [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... futex resumed>) = 0 [pid 510] exit_group(0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] ioctl(3, LOOP_CLR_FD [pid 522] <... set_robust_list resumed>) = 0 [pid 521] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 513] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] getdents64(4, [pid 522] rt_sigprocmask(SIG_SETMASK, [], [pid 521] <... mount resumed>) = 0 [pid 517] mkdir("./bus", 0777 [pid 516] <... futex resumed>) = 0 [pid 515] <... futex resumed>) = ? [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] +++ exited with 0 +++ [pid 510] <... exit_group resumed>) = ? [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 522] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 522] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 521] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 522] <... open resumed>) = 3 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] +++ exited with 0 +++ [pid 298] rmdir("./6/file1" [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 296] close(3 [pid 522] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 522] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 522] <... mount resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 298] close(3 [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 522] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] rmdir("./6" [pid 522] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 517] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 522] <... open resumed>) = 5 [pid 521] <... futex resumed>) = 0 [pid 517] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 516] <... futex resumed>) = 1 [pid 514] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] mkdir("./7", 0777 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... openat resumed>) = 3 [pid 298] <... mkdir resumed>) = 0 [pid 522] <... futex resumed>) = 0 [pid 521] <... open resumed>) = 3 [pid 514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 298] <... openat resumed>) = 3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 523 [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 521] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 522] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 522] <... write resumed>) = 8 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 298] close(3 [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... close resumed>) = 0 [pid 522] <... futex resumed>) = 1 [pid 521] <... write resumed>) = 8 [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 523 attached [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 521] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 525 [pid 523] set_robust_list(0x555556d8d6a0, 24 [pid 522] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 523] <... set_robust_list resumed>) = 0 [pid 522] <... write resumed>) = 1045 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./7/bus", [pid 523] chdir("./7" [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 523] <... chdir resumed>) = 0 [pid 522] <... futex resumed>) = 1 [pid 521] <... write resumed>) = 1045 [pid 514] <... futex resumed>) = 0 [pid 299] unlink("./7/bus" [pid 523] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... prctl resumed>) = 0 [pid 521] <... futex resumed>) = 1 [pid 299] <... unlink resumed>) = 0 [pid 523] setpgid(0, 0 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... futex resumed>) = 0 [pid 299] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 523] <... setpgid resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 523] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] newfstatat(AT_FDCWD, "./7/binderfs", [pid 523] <... openat resumed>) = 3 [pid 523] write(3, "1000", 4) = 4 [pid 523] close(3) = 0 [pid 523] symlink("/dev/binderfs", "./binderfs") = 0 [pid 523] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 523] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 523] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 523] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 523] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 523] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 523] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 525 attached [pid 523] <... clone3 resumed> => {parent_tid=[526]}, 88) = 526 [pid 299] unlink("./7/binderfs" [pid 525] set_robust_list(0x555556d8d6a0, 24 [pid 523] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... set_robust_list resumed>) = 0 [pid 523] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] chdir("./7" [pid 523] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... chdir resumed>) = 0 [pid 523] <... futex resumed>) = 0 [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... prctl resumed>) = 0 [pid 523] <... futex resumed>) = 0 [pid 525] setpgid(0, 0 [pid 523] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 525] <... setpgid resumed>) = 0 [pid 523] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 523] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 525] <... openat resumed>) = 3 [pid 523] <... mprotect resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 525] write(3, "1000", 4 [pid 523] rt_sigprocmask(SIG_BLOCK, ~[], [pid 525] <... write resumed>) = 4 [pid 523] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 525] close(3 [pid 523] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 525] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs" [pid 523] <... clone3 resumed> => {parent_tid=[527]}, 88) = 527 [pid 525] <... symlink resumed>) = 0 [pid 523] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(3 [pid 525] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./7" [pid 525] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 523] <... futex resumed>) = 0 [pid 525] <... rt_sigaction resumed>NULL, 8) = 0 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./8", 0777 [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 525] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 525] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 526 attached ) = -1 ENXIO (No such device or address) [pid 526] set_robust_list(0x7f0c4a20e9a0, 24 [pid 525] <... clone3 resumed> => {parent_tid=[529]}, 88) = 529 [pid 526] <... set_robust_list resumed>) = 0 [pid 525] rt_sigprocmask(SIG_SETMASK, [], [pid 526] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 526] memfd_create("syzkaller", 0 [pid 525] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [ 24.505345][ T518] loop3: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 529 attached ./strace-static-x86_64: Process 527 attached [pid 526] <... memfd_create resumed>) = 3 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 510] +++ exited with 0 +++ [pid 529] set_robust_list(0x7f0c4a20e9a0, 24 [pid 527] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=510, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 529] <... set_robust_list resumed>) = 0 [pid 527] <... set_robust_list resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 532 [pid 529] rt_sigprocmask(SIG_SETMASK, [], [pid 527] rt_sigprocmask(SIG_SETMASK, [], [pid 529] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 527] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 525] <... futex resumed>) = 0 [pid 529] memfd_create("syzkaller", 0 [pid 527] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 529] <... memfd_create resumed>) = 3 [pid 527] <... open resumed>) = 4 [pid 526] <... mmap resumed>) = 0x7f0c41dcd000 [pid 529] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] <... mmap resumed>) = 0x7f0c41dee000 [pid 527] <... futex resumed>) = 1 [pid 523] <... futex resumed>) = 0 [pid 295] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 525] <... mmap resumed>) = 0x7f0c41dcd000 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] <... write resumed>) = 262144 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 525] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 523] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 529] munmap(0x7f0c41dee000, 138412032 [pid 527] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 525] <... mprotect resumed>) = 0 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... openat resumed>) = 3 [pid 529] <... munmap resumed>) = 0 [pid 527] <... mount resumed>) = 0 [pid 526] <... write resumed>) = 262144 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] newfstatat(3, "", [pid 529] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] munmap(0x7f0c41dcd000, 138412032 [pid 525] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 529] <... openat resumed>) = 4 [pid 527] <... futex resumed>) = 1 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 523] <... futex resumed>) = 0 [pid 295] getdents64(3, [pid 529] ioctl(4, LOOP_SET_FD, 3 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] <... munmap resumed>) = 0 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 ./strace-static-x86_64: Process 532 attached [pid 529] <... ioctl resumed>) = 0 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 527] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... open resumed>) = 5 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 523] <... futex resumed>) = 0 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 527] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 523] <... futex resumed>) = 0 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 527] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 533 attached [pid 532] set_robust_list(0x555556d8d6a0, 24 [pid 527] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 526] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 525] <... clone3 resumed> => {parent_tid=[533]}, 88) = 533 [pid 295] <... umount2 resumed>) = 0 [pid 533] set_robust_list(0x7f0c41ded9a0, 24 [pid 532] <... set_robust_list resumed>) = 0 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 533] <... set_robust_list resumed>) = 0 [pid 527] <... futex resumed>) = 1 [pid 523] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 533] rt_sigprocmask(SIG_SETMASK, [], [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] newfstatat(AT_FDCWD, "./6/bus", [pid 533] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] unlink("./6/bus") = 0 [pid 295] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./6/binderfs") = 0 [pid 529] close(3 [pid 295] getdents64(3, [pid 529] <... close resumed>) = 0 [ 24.543851][ T517] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.543878][ T518] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.589061][ T529] loop4: detected capacity change from 0 to 512 [ 24.591365][ T517] EXT4-fs (loop0): get root inode failed [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 532] chdir("./8" [pid 529] mkdir("./file1", 0777 [pid 526] <... openat resumed>) = 6 [pid 525] rt_sigprocmask(SIG_SETMASK, [], [pid 295] close(3 [pid 532] <... chdir resumed>) = 0 [pid 529] <... mkdir resumed>) = 0 [pid 526] ioctl(6, LOOP_SET_FD, 3 [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... close resumed>) = 0 [pid 529] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] rmdir("./6") = 0 [pid 295] mkdir("./7", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 532] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 534 ./strace-static-x86_64: Process 534 attached [pid 534] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 534] chdir("./7") = 0 [pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 534] setpgid(0, 0) = 0 [pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 534] write(3, "1000", 4) = 4 [pid 534] close(3) = 0 [pid 534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 534] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 534] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 534] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[535]}, 88) = 535 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 534] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[], [pid 533] <... futex resumed>) = 0 [pid 532] <... prctl resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 534] <... rt_sigprocmask resumed>[], 8) = 0 [pid 533] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 532] setpgid(0, 0 [pid 526] <... ioctl resumed>) = 0 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 533] <... open resumed>) = 3 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... clone3 resumed> => {parent_tid=[536]}, 88) = 536 [pid 533] <... futex resumed>) = 0 [pid 534] rt_sigprocmask(SIG_SETMASK, [], [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 535 attached [pid 535] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 535] rt_sigprocmask(SIG_SETMASK, [], [pid 532] <... setpgid resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 526] close(3 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) ./strace-static-x86_64: Process 536 attached [pid 533] <... futex resumed>) = 0 [pid 532] <... openat resumed>) = 3 [pid 526] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 517] ioctl(4, LOOP_CLR_FD [pid 533] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 532] write(3, "1000", 4 [pid 526] mkdir("./bus", 0777 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 533] <... mount resumed>) = 0 [pid 532] <... write resumed>) = 4 [pid 526] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 517] <... ioctl resumed>) = 0 [pid 535] memfd_create("syzkaller", 0 [pid 532] close(3 [pid 517] close(4 [pid 535] <... memfd_create resumed>) = 3 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 517] <... close resumed>) = 0 [pid 535] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 535] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 533] <... futex resumed>) = 1 [pid 532] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 517] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 532] symlink("/dev/binderfs", "./binderfs" [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... futex resumed>) = 0 [pid 516] exit_group(0) = ? [pid 535] <... write resumed>) = 262144 [pid 535] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 535] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 535] ioctl(4, LOOP_SET_FD, 3 [pid 536] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 536] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 536] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 525] <... futex resumed>) = 0 [pid 521] <... futex resumed>) = ? [pid 536] <... open resumed>) = 5 [pid 533] <... open resumed>) = 5 [pid 532] <... symlink resumed>) = 0 [ 24.601551][ T517] EXT4-fs (loop0): mount failed [ 24.607322][ T518] EXT4-fs (loop3): get root inode failed [ 24.613165][ T526] loop2: detected capacity change from 0 to 512 [ 24.628180][ T518] EXT4-fs (loop3): mount failed [ 24.639660][ T529] EXT4-fs (loop4): 1 orphan inode deleted [ 24.646146][ T535] loop1: detected capacity change from 0 to 512 [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] +++ exited with 0 +++ [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... mount resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... ioctl resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 532] <... futex resumed>) = 0 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... open resumed>) = 6 [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 518] ioctl(4, LOOP_CLR_FD) = 0 [pid 518] close(4) = 0 [pid 518] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 535] close(3) = 0 [pid 535] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 535] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 533] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 532] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 532] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 532] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 532] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 532] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 532] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[540]}, 88) = 540 [pid 532] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... futex resumed>) = 0 [pid 514] exit_group(0 [pid 532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 532] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 517] +++ exited with 0 +++ [pid 516] +++ exited with 0 +++ [pid 532] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 532] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 532] <... mprotect resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 532] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 532] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 294] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 532] <... clone3 resumed> => {parent_tid=[542]}, 88) = 542 [pid 294] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 532] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... openat resumed>) = 3 [pid 532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] newfstatat(3, "", [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 532] <... futex resumed>) = 0 [pid 294] getdents64(3, [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 522] <... futex resumed>) = ? [pid 518] <... futex resumed>) = ? [pid 514] <... exit_group resumed>) = ? [pid 294] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 522] +++ exited with 0 +++ [pid 518] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 536] <... write resumed>) = 8 [pid 294] unlink("./7/bus"./strace-static-x86_64: Process 542 attached ./strace-static-x86_64: Process 540 attached [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... write resumed>) = 8 [pid 529] <... mount resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 542] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 540] set_robust_list(0x7f0c4a20e9a0, 24 [pid 529] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 294] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 542] <... set_robust_list resumed>) = 0 [pid 540] <... set_robust_list resumed>) = 0 [pid 529] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 542] rt_sigprocmask(SIG_SETMASK, [], [pid 540] rt_sigprocmask(SIG_SETMASK, [], [pid 529] ioctl(4, LOOP_CLR_FD [pid 294] newfstatat(AT_FDCWD, "./7/binderfs", [pid 542] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 529] <... ioctl resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 542] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 540] memfd_create("syzkaller", 0 [pid 529] close(4 [pid 294] unlink("./7/binderfs" [pid 542] <... open resumed>) = 3 [pid 540] <... memfd_create resumed>) = 4 [pid 529] <... close resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 529] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 542] <... futex resumed>) = 1 [pid 540] <... mmap resumed>) = 0x7f0c41dcd000 [pid 532] <... futex resumed>) = 0 [pid 529] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] close(3 [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 540] <... write resumed>) = 262144 [pid 536] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = 0 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 542] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 540] munmap(0x7f0c41dcd000, 138412032 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] rmdir("./7" [pid 542] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 540] <... munmap resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] openat(AT_FDCWD, "/dev/loop5", O_RDWR [ 24.651114][ T529] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.666118][ T529] ext4 filesystem being mounted at /root/syzkaller.qPQybd/7/file1 supports timestamps until 2038 (0x7fffffff) [ 24.690931][ T526] EXT4-fs (loop2): 1 orphan inode deleted [pid 294] mkdir("./8", 0777 [pid 542] <... futex resumed>) = 1 [pid 540] <... openat resumed>) = 5 [pid 532] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] ioctl(5, LOOP_SET_FD, 4 [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 540] <... ioctl resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... futex resumed>) = 1 [pid 532] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 542] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 540] close(4 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] ioctl(3, LOOP_CLR_FD [pid 542] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 540] <... close resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] mkdir("./file1", 0777 [pid 294] close(3 [pid 542] <... futex resumed>) = 1 [pid 540] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 532] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] <... futex resumed>) = 0 [pid 542] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 544 [pid 542] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 532] <... futex resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] <... futex resumed>) = 0 [pid 542] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 532] <... futex resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 525] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 544 attached [pid 536] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 514] +++ exited with 0 +++ [pid 544] set_robust_list(0x555556d8d6a0, 24 [pid 536] <... write resumed>) = 1045 [pid 525] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] <... set_robust_list resumed>) = 0 [pid 544] chdir("./8") = 0 [pid 544] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 544] setpgid(0, 0) = 0 [pid 544] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 544] write(3, "1000", 4) = 4 [pid 544] close(3) = 0 [pid 544] symlink("/dev/binderfs", "./binderfs") = 0 [pid 544] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 544] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 544] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[546]}, 88) = 546 [pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 544] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 544] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[547]}, 88) = 547 [pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=514, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- ./strace-static-x86_64: Process 547 attached ./strace-static-x86_64: Process 546 attached [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 24.702642][ T526] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.708766][ T540] loop5: detected capacity change from 0 to 512 [ 24.715291][ T526] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/7/bus supports timestamps until 2038 (0x7fffffff) [ 24.736970][ T535] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 529] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 536] <... futex resumed>) = 1 [pid 547] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 547] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 547] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] <... futex resumed>) = 0 [pid 529] <... write resumed>) = 1045 [pid 297] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] set_robust_list(0x7f0c4a20e9a0, 24 [pid 529] <... futex resumed>) = 1 [pid 526] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 525] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 546] <... set_robust_list resumed>) = 0 [pid 529] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] ioctl(6, LOOP_CLR_FD [pid 525] exit_group(0 [pid 546] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... openat resumed>) = 3 [pid 525] <... exit_group resumed>) = ? [pid 533] <... futex resumed>) = 3 [pid 529] <... futex resumed>) = ? [pid 297] newfstatat(3, "", [pid 533] +++ exited with 0 +++ [pid 547] <... futex resumed>) = 1 [pid 544] <... futex resumed>) = 0 [pid 547] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 547] <... mount resumed>) = 0 [pid 546] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 544] <... futex resumed>) = 0 [pid 529] +++ exited with 0 +++ [pid 526] <... ioctl resumed>) = 0 [pid 525] +++ exited with 0 +++ [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] memfd_create("syzkaller", 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 526] close(6 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] getdents64(3, [pid 547] <... futex resumed>) = 0 [pid 546] <... memfd_create resumed>) = 4 [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 526] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 547] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 546] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 547] <... open resumed>) = 5 [pid 546] <... mmap resumed>) = 0x7f0c41dcd000 [pid 544] <... futex resumed>) = 0 [pid 526] <... futex resumed>) = 0 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... futex resumed>) = 0 [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 547] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 546] <... write resumed>) = 262144 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = ? [pid 526] <... futex resumed>) = ? [pid 523] <... exit_group resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 546] munmap(0x7f0c41dcd000, 138412032 [pid 527] +++ exited with 0 +++ [pid 526] +++ exited with 0 +++ [pid 298] newfstatat(3, "", [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 547] <... futex resumed>) = 1 [pid 546] <... munmap resumed>) = 0 [pid 544] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = 0 [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 544] <... futex resumed>) = 0 [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] <... openat resumed>) = 6 [ 24.752667][ T535] EXT4-fs error (device loop1): ext4_quota_enable:6369: comm syz-executor170: Bad quota inode: 3, type: 0 [ 24.778968][ T535] EXT4-fs warning (device loop1): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 24.783865][ T540] EXT4-fs (loop5): 1 orphan inode deleted [ 24.794391][ T535] EXT4-fs (loop1): mount failed [pid 297] newfstatat(AT_FDCWD, "./7/bus", [pid 546] ioctl(6, LOOP_SET_FD, 4 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 546] <... ioctl resumed>) = 0 [pid 546] close(4) = 0 [pid 546] mkdir("./file1", 0777) = 0 [pid 546] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] unlink("./7/bus") = 0 [pid 297] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./7/binderfs") = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./7/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./7") = 0 [pid 297] mkdir("./8", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 550 ./strace-static-x86_64: Process 550 attached [pid 550] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 550] chdir("./8") = 0 [pid 550] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 550] setpgid(0, 0) = 0 [pid 550] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 550] write(3, "1000", 4) = 4 [pid 550] close(3) = 0 [pid 550] symlink("/dev/binderfs", "./binderfs") = 0 [pid 550] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 550] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./7/bus", [pid 535] ioctl(4, LOOP_CLR_FD) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./7/bus" [pid 535] close(4 [pid 550] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 550] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] <... unlink resumed>) = 0 [pid 535] <... close resumed>) = 0 [pid 535] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 535] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 535] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] exit_group(0 [pid 298] newfstatat(AT_FDCWD, "./7/binderfs", [pid 536] <... futex resumed>) = ? [pid 534] <... exit_group resumed>) = ? [pid 536] +++ exited with 0 +++ [pid 535] <... futex resumed>) = ? [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 550] <... clone3 resumed> => {parent_tid=[551]}, 88) = 551 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 550] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 550] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] unlink("./7/binderfs" [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[552]}, 88) = 552 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 552 attached ./strace-static-x86_64: Process 551 attached [pid 550] <... futex resumed>) = 0 [pid 523] +++ exited with 0 +++ [pid 552] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=523, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 552] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 552] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 296] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... openat resumed>) = 3 [pid 551] set_robust_list(0x7f0c4a20e9a0, 24 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(3, "", [pid 551] <... set_robust_list resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 24.799871][ T540] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.804453][ T546] loop0: detected capacity change from 0 to 512 [ 24.815523][ T540] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./7/bus") = 0 [pid 296] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./7/binderfs") = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./7") = 0 [pid 296] mkdir("./8", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 555 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 551] memfd_create("syzkaller", 0) = 4 [pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 551] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 552] <... futex resumed>) = 0 [pid 551] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 551] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [pid 551] ioctl(5, LOOP_SET_FD, 4 [pid 552] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 535] +++ exited with 0 +++ [pid 534] +++ exited with 0 +++ ./strace-static-x86_64: Process 555 attached [pid 552] <... mount resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] <... umount2 resumed>) = 0 [pid 295] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 298] newfstatat(AT_FDCWD, "./7/file1", [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./7/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 555] set_robust_list(0x555556d8d6a0, 24 [pid 298] rmdir("./7" [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./7/bus") = 0 [pid 295] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./7/binderfs", [pid 298] <... rmdir resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./7/binderfs") = 0 [pid 298] mkdir("./8", 0777 [pid 295] getdents64(3, [pid 298] <... mkdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] rmdir("./7" [pid 298] <... openat resumed>) = 3 [pid 295] <... rmdir resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] mkdir("./8", 0777 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 555] <... set_robust_list resumed>) = 0 [pid 546] <... mount resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 555] chdir("./8" [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... ioctl resumed>) = 0 [pid 555] <... chdir resumed>) = 0 [pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 555] <... prctl resumed>) = 0 [pid 552] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] setpgid(0, 0 [pid 552] <... open resumed>) = 6 [pid 550] <... futex resumed>) = 0 [pid 546] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 555] <... setpgid resumed>) = 0 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 552] <... futex resumed>) = 0 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 546] <... openat resumed>) = 4 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] ioctl(3, LOOP_CLR_FD [pid 555] <... openat resumed>) = 3 [pid 552] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 551] close(4 [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 555] write(3, "1000", 4 [pid 551] <... close resumed>) = 0 [pid 550] <... futex resumed>) = 0 [pid 546] chdir("./file1" [pid 295] close(3 [pid 555] <... write resumed>) = 4 [pid 551] mkdir("./file1", 0777 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] close(3 [pid 551] <... mkdir resumed>) = 0 [pid 546] <... chdir resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 557 [pid 295] <... close resumed>) = 0 [pid 555] <... close resumed>) = 0 [pid 555] symlink("/dev/binderfs", "./binderfs" [pid 551] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 546] ioctl(6, LOOP_CLR_FD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 555] <... symlink resumed>) = 0 [pid 546] <... ioctl resumed>) = 0 [pid 555] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] close(6 [pid 555] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 546] <... close resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 558 [pid 555] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 546] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 546] <... futex resumed>) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 546] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 555] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 558 attached ./strace-static-x86_64: Process 557 attached [pid 552] <... write resumed>) = 8 ./strace-static-x86_64: Process 559 attached [pid 558] set_robust_list(0x555556d8d6a0, 24 [pid 557] set_robust_list(0x555556d8d6a0, 24 [pid 555] <... clone3 resumed> => {parent_tid=[559]}, 88) = 559 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 559] set_robust_list(0x7f0c4a20e9a0, 24 [pid 558] <... set_robust_list resumed>) = 0 [pid 557] <... set_robust_list resumed>) = 0 [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 544] exit_group(0 [pid 540] ioctl(5, LOOP_CLR_FD [pid 559] <... set_robust_list resumed>) = 0 [pid 558] chdir("./8" [pid 557] chdir("./8" [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... futex resumed>) = ? [pid 546] <... futex resumed>) = ? [pid 544] <... exit_group resumed>) = ? [pid 559] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... chdir resumed>) = 0 [pid 557] <... chdir resumed>) = 0 [pid 555] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 550] <... futex resumed>) = 0 [pid 547] +++ exited with 0 +++ [pid 546] +++ exited with 0 +++ [pid 559] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 557] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 555] <... futex resumed>) = 0 [pid 552] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] +++ exited with 0 +++ [pid 559] memfd_create("syzkaller", 0 [pid 558] <... prctl resumed>) = 0 [pid 557] <... prctl resumed>) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... write resumed>) = 1045 [pid 559] <... memfd_create resumed>) = 3 [pid 558] setpgid(0, 0 [pid 557] setpgid(0, 0 [pid 555] <... futex resumed>) = 0 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 558] <... setpgid resumed>) = 0 [pid 557] <... setpgid resumed>) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=544, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 559] <... mmap resumed>) = 0x7f0c41dee000 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 557] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 555] <... mmap resumed>) = 0x7f0c41dcd000 [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 558] <... openat resumed>) = 3 [pid 557] <... openat resumed>) = 3 [pid 555] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 559] <... write resumed>) = 262144 [pid 558] write(3, "1000", 4 [pid 557] write(3, "1000", 4 [pid 555] <... mprotect resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 559] munmap(0x7f0c41dee000, 138412032 [pid 558] <... write resumed>) = 4 [pid 557] <... write resumed>) = 4 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [pid 559] <... munmap resumed>) = 0 [ 24.850658][ T546] EXT4-fs (loop0): 1 orphan inode deleted [ 24.858803][ T546] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.859683][ T551] loop3: detected capacity change from 0 to 512 [ 24.878835][ T546] ext4 filesystem being mounted at /root/syzkaller.iF59aB/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 558] close(3 [pid 557] close(3 [pid 555] <... rt_sigprocmask resumed>[], 8) = 0 [pid 559] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 558] <... close resumed>) = 0 [pid 557] <... close resumed>) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 559] <... openat resumed>) = 4 [pid 558] symlink("/dev/binderfs", "./binderfs" [pid 557] symlink("/dev/binderfs", "./binderfs" [pid 559] ioctl(4, LOOP_SET_FD, 3 [pid 558] <... symlink resumed>) = 0 [pid 557] <... symlink resumed>) = 0 [pid 555] <... clone3 resumed> => {parent_tid=[562]}, 88) = 562 [pid 294] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 562 attached [pid 562] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 562] rt_sigprocmask(SIG_SETMASK, [], [pid 559] <... ioctl resumed>) = 0 [pid 558] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 540] <... ioctl resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 562] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 559] close(3 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] close(5 [pid 294] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 562] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 559] <... close resumed>) = 0 [pid 558] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 557] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 540] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 559] mkdir("./bus", 0777 [pid 558] <... rt_sigaction resumed>NULL, 8) = 0 [pid 557] <... rt_sigaction resumed>NULL, 8) = 0 [pid 555] <... futex resumed>) = 0 [pid 540] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] <... open resumed>) = -1 EISDIR (Is a directory) [pid 559] <... mkdir resumed>) = 0 [pid 558] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 557] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... futex resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./8/bus", [pid 559] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 557] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 551] ioctl(5, LOOP_CLR_FD [pid 562] <... futex resumed>) = 1 [pid 558] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 557] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 555] <... futex resumed>) = 0 [pid 551] <... ioctl resumed>) = 0 [pid 294] unlink("./8/bus" [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 557] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] close(5 [pid 532] exit_group(0 [pid 562] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 558] <... mprotect resumed>) = 0 [pid 557] <... mprotect resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 551] <... close resumed>) = 0 [pid 542] <... futex resumed>) = ? [pid 540] <... futex resumed>) = ? [pid 532] <... exit_group resumed>) = ? [pid 294] <... unlink resumed>) = 0 [pid 562] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [pid 557] rt_sigprocmask(SIG_BLOCK, ~[], [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] exit_group(0 [pid 542] +++ exited with 0 +++ [pid 540] +++ exited with 0 +++ [pid 532] +++ exited with 0 +++ [pid 558] <... rt_sigprocmask resumed>[], 8) = 0 [pid 557] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=532, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 550] <... exit_group resumed>) = ? [pid 552] <... futex resumed>) = ? [pid 294] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 557] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 551] <... futex resumed>) = ? [pid 552] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 565 attached ./strace-static-x86_64: Process 564 attached [pid 562] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 558] <... clone3 resumed> => {parent_tid=[564]}, 88) = 564 [pid 557] <... clone3 resumed> => {parent_tid=[565]}, 88) = 565 [pid 294] newfstatat(AT_FDCWD, "./8/binderfs", [pid 558] rt_sigprocmask(SIG_SETMASK, [], [pid 557] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 557] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 558] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 557] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 558] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 557] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 558] <... mprotect resumed>) = 0 [pid 557] <... mprotect resumed>) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [pid 557] rt_sigprocmask(SIG_BLOCK, ~[], [pid 558] <... rt_sigprocmask resumed>[], 8) = 0 [pid 557] <... rt_sigprocmask resumed>[], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 557] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 558] <... clone3 resumed> => {parent_tid=[567]}, 88) = 567 [pid 557] <... clone3 resumed> => {parent_tid=[568]}, 88) = 568 [pid 558] rt_sigprocmask(SIG_SETMASK, [], [pid 557] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 568 attached [ 24.929797][ T551] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.934950][ T559] loop2: detected capacity change from 0 to 512 [ 24.949764][ T551] EXT4-fs (loop3): get root inode failed [ 24.955425][ T551] EXT4-fs (loop3): mount failed [pid 568] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 565] set_robust_list(0x7f0c4a20e9a0, 24 [pid 564] set_robust_list(0x7f0c4a20e9a0, 24 [pid 562] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 0 [pid 294] unlink("./8/binderfs" [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 568] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... futex resumed>) = 1 [pid 568] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 567 attached [pid 567] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] rt_sigprocmask(SIG_SETMASK, [], [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 567] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 568] <... futex resumed>) = 1 [pid 567] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 568] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 567] <... open resumed>) = 3 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... futex resumed>) = 1 [pid 568] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 1 [pid 557] <... futex resumed>) = 0 [pid 568] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 1 [pid 567] <... futex resumed>) = 1 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 568] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 567] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... mount resumed>) = 0 [pid 558] <... futex resumed>) = 0 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 567] <... futex resumed>) = 0 [pid 558] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 567] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... open resumed>) = 4 [pid 565] <... set_robust_list resumed>) = 0 [pid 564] <... set_robust_list resumed>) = 0 [pid 562] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 558] <... futex resumed>) = 0 [pid 299] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] rt_sigprocmask(SIG_SETMASK, [], [pid 564] rt_sigprocmask(SIG_SETMASK, [], [pid 562] <... open resumed>) = -1 EISDIR (Is a directory) [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 567] <... futex resumed>) = 0 [pid 565] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 564] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] memfd_create("syzkaller", 0 [pid 564] memfd_create("syzkaller", 0 [pid 562] <... futex resumed>) = 1 [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 567] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 565] <... memfd_create resumed>) = 5 [pid 564] <... memfd_create resumed>) = 5 [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] <... futex resumed>) = 0 [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 567] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 565] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 562] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 567] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 565] <... mmap resumed>) = 0x7f0c41dcd000 [pid 564] <... mmap resumed>) = 0x7f0c41dcd000 [pid 562] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 559] <... mount resumed>) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] getdents64(3, [pid 559] <... openat resumed>) = 3 [pid 559] chdir("./bus") = 0 [pid 559] ioctl(4, LOOP_CLR_FD) = 0 [pid 559] close(4) = 0 [pid 559] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 562] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 299] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./8/binderfs") = 0 [pid 299] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./8/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./8") = 0 [pid 299] mkdir("./9", 0777 [pid 558] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 551] +++ exited with 0 +++ [pid 550] +++ exited with 0 +++ [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 569 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=550, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 564] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 297] <... restart_syscall resumed>) = 0 [pid 564] <... write resumed>) = 262144 [ 24.974780][ T559] EXT4-fs (loop2): 1 orphan inode deleted [ 24.981106][ T559] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.993266][ T559] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/8/bus supports timestamps until 2038 (0x7fffffff) [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 569 attached [pid 567] <... futex resumed>) = 0 [pid 565] <... write resumed>) = 262144 [pid 564] munmap(0x7f0c41dcd000, 138412032 [pid 559] <... futex resumed>) = 0 [pid 558] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 1 [pid 569] set_robust_list(0x555556d8d6a0, 24 [pid 567] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 565] munmap(0x7f0c41dcd000, 138412032 [pid 564] <... munmap resumed>) = 0 [pid 559] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] <... set_robust_list resumed>) = 0 [pid 567] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 565] <... munmap resumed>) = 0 [pid 564] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 559] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] chdir("./9" [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 564] <... openat resumed>) = 6 [pid 559] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 569] <... chdir resumed>) = 0 [pid 567] <... futex resumed>) = 1 [pid 565] <... openat resumed>) = 6 [pid 564] ioctl(6, LOOP_SET_FD, 5 [pid 559] <... futex resumed>) = 1 [pid 558] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 569] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] ioctl(6, LOOP_SET_FD, 5 [pid 559] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] exit_group(0 [pid 569] <... prctl resumed>) = 0 [pid 564] <... ioctl resumed>) = 0 [pid 297] newfstatat(3, "", [pid 569] setpgid(0, 0 [pid 564] close(5 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 569] <... setpgid resumed>) = 0 [pid 564] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 569] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 564] mkdir("./file1", 0777 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 569] <... openat resumed>) = 3 [pid 564] <... mkdir resumed>) = 0 [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] write(3, "1000", 4 [pid 564] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 569] <... write resumed>) = 4 [pid 569] close(3) = 0 [pid 569] symlink("/dev/binderfs", "./binderfs" [pid 297] <... umount2 resumed>) = 0 [pid 569] <... symlink resumed>) = 0 [pid 562] <... futex resumed>) = ? [pid 559] <... futex resumed>) = ? [pid 555] <... exit_group resumed>) = ? [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... ioctl resumed>) = 0 [pid 562] +++ exited with 0 +++ [pid 559] +++ exited with 0 +++ [pid 555] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 565] close(5 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 565] <... close resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] mkdir("./file1", 0777) = 0 [pid 565] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 569] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./8/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./8/file1", [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] unlink("./8/bus" [pid 296] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 569] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] <... unlink resumed>) = 0 [pid 296] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] <... mprotect resumed>) = 0 [pid 297] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 294] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(3, "", [pid 294] <... openat resumed>) = 4 [pid 569] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./8/binderfs", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(4, "", [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] unlink("./8/binderfs" [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] getdents64(4, [pid 569] <... clone3 resumed> => {parent_tid=[572]}, 88) = 572 [pid 297] <... unlink resumed>) = 0 [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 572 attached [pid 569] rt_sigprocmask(SIG_SETMASK, [], [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(4, [pid 569] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 569] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./8/file1", [pid 294] close(4 [pid 569] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] rmdir("./8/file1" [pid 569] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... rmdir resumed>) = 0 [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] getdents64(3, [pid 569] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] <... openat resumed>) = 4 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 569] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] newfstatat(4, "", [pid 294] close(3 [pid 569] <... mprotect resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... close resumed>) = 0 [ 25.024705][ T564] loop1: detected capacity change from 0 to 512 [ 25.026867][ T565] loop4: detected capacity change from 0 to 512 [ 25.048642][ T564] EXT4-fs (loop1): 1 orphan inode deleted [ 25.054285][ T564] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] getdents64(4, [pid 294] rmdir("./8" [pid 569] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... rmdir resumed>) = 0 [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] getdents64(4, [pid 294] mkdir("./9", 0777 [pid 572] set_robust_list(0x7f0c4a20e9a0, 24 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 572] <... set_robust_list resumed>) = 0 [pid 569] <... clone3 resumed> => {parent_tid=[574]}, 88) = 574 [pid 297] close(4 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 569] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... close resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 569] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] rmdir("./8/file1" [pid 294] ioctl(3, LOOP_CLR_FD [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... rmdir resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 569] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 294] close(3 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 297] close(3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./8" [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 576 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./9", 0777./strace-static-x86_64: Process 574 attached [pid 572] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... mkdir resumed>) = 0 [pid 572] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 572] memfd_create("syzkaller", 0 [pid 297] <... openat resumed>) = 3 [pid 572] <... memfd_create resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 572] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 572] <... mmap resumed>) = 0x7f0c41dcd000 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 577 [pid 564] <... mount resumed>) = 0 [pid 564] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 564] chdir("./file1") = 0 [pid 564] ioctl(6, LOOP_CLR_FD) = 0 [pid 564] close(6) = 0 [pid 564] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 576 attached [pid 576] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 574] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 572] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 558] exit_group(0 [pid 567] <... futex resumed>) = ? [pid 564] <... futex resumed>) = ? [pid 558] <... exit_group resumed>) = ? [pid 574] <... set_robust_list resumed>) = 0 [pid 572] <... write resumed>) = 262144 [pid 567] +++ exited with 0 +++ [pid 564] +++ exited with 0 +++ [pid 558] +++ exited with 0 +++ [pid 572] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 572] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 572] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 577 attached [pid 576] chdir("./9" [pid 574] rt_sigprocmask(SIG_SETMASK, [], [pid 565] <... mount resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=558, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 574] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 565] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 574] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 565] <... openat resumed>) = 5 [pid 574] <... open resumed>) = 5 [pid 565] chdir("./file1" [ 25.065631][ T564] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/8/file1 supports timestamps until 2038 (0x7fffffff) [ 25.090744][ T565] EXT4-fs (loop4): 1 orphan inode deleted [ 25.096382][ T565] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.109521][ T565] ext4 filesystem being mounted at /root/syzkaller.qPQybd/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 295] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... chdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 565] ioctl(6, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... ioctl resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 565] close(6 [pid 295] newfstatat(3, "", [pid 577] set_robust_list(0x555556d8d6a0, 24 [pid 576] <... chdir resumed>) = 0 [pid 574] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 572] <... ioctl resumed>) = 0 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... set_robust_list resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 577] chdir("./9" [pid 576] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 574] <... mount resumed>) = 0 [pid 572] close(3 [pid 565] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 565] <... futex resumed>) = 0 [pid 557] exit_group(0 [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = ? [pid 557] <... exit_group resumed>) = ? [pid 577] <... chdir resumed>) = 0 [pid 576] <... prctl resumed>) = 0 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 568] +++ exited with 0 +++ [pid 565] +++ exited with 0 +++ [pid 557] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = 0 [pid 577] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 576] setpgid(0, 0 [pid 574] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... prctl resumed>) = 0 [pid 576] <... setpgid resumed>) = 0 [pid 574] <... open resumed>) = 6 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=557, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] setpgid(0, 0 [pid 576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 295] newfstatat(AT_FDCWD, "./8/bus", [pid 577] <... setpgid resumed>) = 0 [pid 576] <... openat resumed>) = 3 [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./8/bus" [pid 577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 576] write(3, "1000", 4 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 572] mkdir("./bus", 0777 [pid 569] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 577] <... openat resumed>) = 3 [pid 574] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 577] write(3, "1000", 4 [pid 576] <... write resumed>) = 4 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... write resumed>) = 4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] close(3 [pid 298] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] newfstatat(AT_FDCWD, "./8/binderfs", [pid 576] close(3 [pid 574] <... write resumed>) = 8 [pid 572] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 577] <... close resumed>) = 0 [pid 576] <... close resumed>) = 0 [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... openat resumed>) = 3 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] symlink("/dev/binderfs", "./binderfs" [pid 576] symlink("/dev/binderfs", "./binderfs" [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 295] unlink("./8/binderfs" [pid 577] <... symlink resumed>) = 0 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 577] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 577] <... futex resumed>) = 0 [pid 576] <... symlink resumed>) = 0 [pid 574] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 576] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... rt_sigaction resumed>NULL, 8) = 0 [pid 576] <... futex resumed>) = 0 [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 577] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... umount2 resumed>) = 0 [pid 577] <... rt_sigprocmask resumed>[], 8) = 0 [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[579]}, 88) = 579 [pid 577] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 577] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./8/bus", [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 576] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 577] <... mprotect resumed>) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 574] <... write resumed>) = 1045 [pid 298] unlink("./8/bus" [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 576] <... rt_sigaction resumed>NULL, 8) = 0 [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 569] <... futex resumed>) = 0 [pid 576] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... unlink resumed>) = 0 [pid 577] <... clone3 resumed> => {parent_tid=[580]}, 88) = 580 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 579 attached [pid 579] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 579] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 579] memfd_create("syzkaller", 0) = 3 [pid 579] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 579] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 579] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 579] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 580 attached [pid 576] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 579] ioctl(4, LOOP_SET_FD, 3 [pid 580] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 579] <... ioctl resumed>) = 0 [pid 579] close(3) = 0 [pid 579] mkdir("./file1", 0777) = 0 [pid 579] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 580] <... set_robust_list resumed>) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 580] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 577] <... futex resumed>) = 0 [pid 580] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... mount resumed>) = 0 [pid 577] <... futex resumed>) = 0 [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... futex resumed>) = 0 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 576] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 576] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(AT_FDCWD, "./8/binderfs", [pid 576] <... mprotect resumed>) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[581]}, 88) = 581 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 576] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 576] <... rt_sigprocmask resumed>[], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[582]}, 88) = 582 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 581 attached [pid 581] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 581] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 581] memfd_create("syzkaller", 0) = 3 [pid 581] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 581] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 581] munmap(0x7f0c41dcd000, 138412032 [pid 298] unlink("./8/binderfs" [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] <... munmap resumed>) = 0 [pid 581] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 577] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 580] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 581] <... openat resumed>) = 4 [pid 581] ioctl(4, LOOP_SET_FD, 3 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 25.114389][ T572] loop5: detected capacity change from 0 to 512 [ 25.143578][ T572] ================================================================================ [ 25.153047][ T572] UBSAN: shift-out-of-bounds in fs/ext4/super.c:4423:27 [ 25.153993][ T579] loop3: detected capacity change from 0 to 512 [ 25.160033][ T572] shift exponent 59 is too large for 32-bit type 'int' [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... open resumed>) = 5 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./8/bus", [pid 581] <... ioctl resumed>) = 0 [pid 581] close(3) = 0 [pid 581] mkdir("./file1", 0777) = 0 [pid 580] <... futex resumed>) = 1 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] <... futex resumed>) = 0 [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 577] <... futex resumed>) = 0 [pid 580] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 582 attached [pid 580] <... write resumed>) = 8 [pid 296] openat(AT_FDCWD, "./8/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = 0 [pid 580] <... futex resumed>) = 1 [pid 577] <... futex resumed>) = 0 [pid 296] newfstatat(4, "", [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 577] <... futex resumed>) = 0 [pid 296] getdents64(4, [pid 295] newfstatat(AT_FDCWD, "./8/file1", [pid 580] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.178824][ T581] loop0: detected capacity change from 0 to 512 [ 25.186822][ T572] CPU: 0 PID: 572 Comm: syz-executor170 Not tainted 5.15.141-syzkaller-00899-g28e3f5851a99 #0 [ 25.196909][ T572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 25.206804][ T572] Call Trace: [ 25.209923][ T572] [ 25.212697][ T572] dump_stack_lvl+0x151/0x1b7 [ 25.217209][ T572] ? io_uring_drop_tctx_refs+0x190/0x190 [ 25.222678][ T572] ? guard_bio_eod+0xf4/0x140 [ 25.227192][ T572] dump_stack+0x15/0x17 [ 25.231180][ T572] __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 [ 25.237523][ T572] ? ext4_max_size+0xa3/0x120 [ 25.242031][ T572] ext4_fill_super+0x7491/0x96e0 [ 25.246898][ T572] ? ext4_mount+0x40/0x40 [ 25.251058][ T572] ? vscnprintf+0x80/0x80 [ 25.255225][ T572] ? set_blocksize+0x1f0/0x380 [ 25.259822][ T572] ? sb_set_blocksize+0xa8/0xf0 [ 25.264598][ T572] mount_bdev+0x282/0x3b0 [ 25.268762][ T572] ? ext4_mount+0x40/0x40 [ 25.273019][ T572] ext4_mount+0x34/0x40 [ 25.277009][ T572] legacy_get_tree+0xf1/0x190 [ 25.281525][ T572] ? ext4_errno_to_code+0x140/0x140 [ 25.286555][ T572] vfs_get_tree+0x88/0x290 [ 25.290812][ T572] do_new_mount+0x28b/0xad0 [ 25.295165][ T572] ? do_move_mount_old+0x160/0x160 [ 25.300442][ T572] ? security_capable+0x87/0xb0 [ 25.305129][ T572] ? ns_capable+0x89/0xe0 [ 25.309294][ T572] path_mount+0x671/0x1070 [ 25.313550][ T572] __se_sys_mount+0x2c4/0x3b0 [ 25.318061][ T572] ? __x64_sys_mount+0xd0/0xd0 [ 25.322663][ T572] ? __kasan_check_read+0x11/0x20 [ 25.327528][ T572] __x64_sys_mount+0xbf/0xd0 [ 25.331953][ T572] do_syscall_64+0x3d/0xb0 [ 25.336201][ T572] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.342017][ T572] RIP: 0033:0x7f0c4a25309a [ 25.346271][ T572] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 25.365708][ T572] RSP: 002b:00007f0c4a20e088 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [pid 580] <... write resumed>) = 1045 [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 576] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 296] getdents64(4, [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ac000 [pid 576] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} => {parent_tid=[584]}, 88) = 584 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 582] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 584 attached [pid 296] close(4 [pid 295] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./8/bus" [pid 295] <... openat resumed>) = 4 [pid 296] <... rmdir resumed>) = 0 [pid 295] newfstatat(4, "", [pid 584] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 584] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 584] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [ 25.373961][ T572] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f0c4a25309a [ 25.381885][ T572] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 00007f0c4a20e0a0 [ 25.389665][ T572] RBP: 00007f0c4a20e0a0 R08: 00007f0c4a20e0e0 R09: 00000000000004d6 [ 25.397565][ T572] R10: 0000000000004500 R11: 0000000000000202 R12: 00007f0c4a20e0e0 [ 25.405373][ T572] R13: 0000000000004500 R14: 0000000000000003 R15: 0000000000040000 [ 25.413189][ T572] [ 25.416554][ T572] ================================================================================ [pid 584] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = 1 [pid 582] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... open resumed>) = 5 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 576] <... futex resumed>) = 0 [pid 582] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = 8 [pid 576] <... futex resumed>) = 0 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = 1045 [pid 576] <... futex resumed>) = 0 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... futex resumed>) = 1 [pid 584] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 572] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(4, [pid 296] newfstatat(AT_FDCWD, "./8/binderfs", [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] getdents64(4, [pid 296] unlink("./8/binderfs" [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] close(4 [pid 296] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./8/file1" [pid 296] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 296] rmdir("./8" [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 296] mkdir("./9", 0777 [pid 295] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] rmdir("./8" [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] mkdir("./9", 0777 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... mkdir resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] close(3 [pid 295] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 588 [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 589 ./strace-static-x86_64: Process 588 attached [pid 588] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 588] chdir("./9") = 0 [pid 588] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 588] setpgid(0, 0) = 0 [pid 588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 588] write(3, "1000", 4) = 4 [pid 588] close(3) = 0 [pid 588] symlink("/dev/binderfs", "./binderfs") = 0 [pid 588] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 588] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 588] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[591]}, 88) = 591 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 591 attached ./strace-static-x86_64: Process 589 attached [pid 572] ioctl(4, LOOP_CLR_FD [pid 591] set_robust_list(0x7f0c4a20e9a0, 24 [pid 589] set_robust_list(0x555556d8d6a0, 24 [pid 572] <... ioctl resumed>) = 0 [pid 591] <... set_robust_list resumed>) = 0 [pid 589] <... set_robust_list resumed>) = 0 [pid 572] close(4 [pid 591] rt_sigprocmask(SIG_SETMASK, [], [pid 589] chdir("./9" [pid 572] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 591] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 589] <... chdir resumed>) = 0 [pid 572] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 591] memfd_create("syzkaller", 0 [pid 589] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 572] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 591] <... memfd_create resumed>) = 3 [pid 589] <... prctl resumed>) = 0 [pid 579] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 572] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./8/file1", [pid 591] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 589] setpgid(0, 0 [pid 579] ioctl(4, LOOP_CLR_FD [pid 569] exit_group(0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 591] <... mmap resumed>) = 0x7f0c41dee000 [ 25.426795][ T572] EXT4-fs (loop5): fragment/cluster size (0) != block size (4096) [ 25.434129][ T579] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.450269][ T579] EXT4-fs (loop3): get root inode failed [ 25.456106][ T579] EXT4-fs (loop3): mount failed [ 25.466777][ T581] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 589] <... setpgid resumed>) = 0 [pid 579] <... ioctl resumed>) = 0 [pid 574] <... futex resumed>) = ? [pid 572] <... futex resumed>) = ? [pid 569] <... exit_group resumed>) = ? [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 591] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 588] <... mmap resumed>) = 0x7f0c41dcd000 [pid 579] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 591] <... write resumed>) = 262144 [pid 589] <... openat resumed>) = 3 [pid 579] <... close resumed>) = 0 [pid 574] +++ exited with 0 +++ [pid 572] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 591] munmap(0x7f0c41dee000, 138412032 [pid 589] write(3, "1000", 4 [pid 588] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 579] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 4 [pid 591] <... munmap resumed>) = 0 [pid 589] <... write resumed>) = 4 [pid 579] <... futex resumed>) = 0 [pid 298] newfstatat(4, "", [pid 591] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 589] close(3 [pid 579] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 591] <... openat resumed>) = 4 [pid 589] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 591] ioctl(4, LOOP_SET_FD, 3 [pid 589] symlink("/dev/binderfs", "./binderfs" [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 591] <... ioctl resumed>) = 0 [pid 589] <... symlink resumed>) = 0 [pid 588] <... mprotect resumed>) = 0 [pid 298] getdents64(4, [pid 589] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 589] <... futex resumed>) = 0 [pid 298] close(4 [pid 589] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... close resumed>) = 0 [pid 589] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] rmdir("./8/file1" [pid 589] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... rmdir resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(3, [pid 589] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 589] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] close(3 [pid 589] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... close resumed>) = 0 [pid 589] <... mprotect resumed>) = 0 [pid 298] rmdir("./8" [pid 589] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... rmdir resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] mkdir("./9", 0777 [pid 589] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 589] <... clone3 resumed> => {parent_tid=[592]}, 88) = 592 [pid 298] <... openat resumed>) = 3 [pid 589] rt_sigprocmask(SIG_SETMASK, [], [pid 298] ioctl(3, LOOP_CLR_FD [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 589] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 589] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 589] <... futex resumed>) = 0 [pid 589] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 593 [pid 589] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 589] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 589] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 589] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[594]}, 88) = 594 [pid 591] close(3 [pid 589] rt_sigprocmask(SIG_SETMASK, [], [pid 591] <... close resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 591] mkdir("./file1", 0777 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 594 attached ./strace-static-x86_64: Process 593 attached ./strace-static-x86_64: Process 592 attached [pid 591] <... mkdir resumed>) = 0 [pid 589] <... futex resumed>) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [pid 577] exit_group(0 [pid 594] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 593] set_robust_list(0x555556d8d6a0, 24 [pid 592] set_robust_list(0x7f0c4a20e9a0, 24 [pid 591] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 594] <... set_robust_list resumed>) = 0 [pid 593] <... set_robust_list resumed>) = 0 [pid 592] <... set_robust_list resumed>) = 0 [pid 588] <... rt_sigprocmask resumed>[], 8) = 0 [pid 580] <... futex resumed>) = ? [pid 579] <... futex resumed>) = ? [pid 577] <... exit_group resumed>) = ? [pid 594] rt_sigprocmask(SIG_SETMASK, [], [pid 593] chdir("./9" [pid 592] rt_sigprocmask(SIG_SETMASK, [], [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 581] ioctl(4, LOOP_CLR_FD [pid 580] +++ exited with 0 +++ [pid 579] +++ exited with 0 +++ [pid 581] <... ioctl resumed>) = 0 [pid 581] close(4) = 0 [pid 581] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 581] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 576] exit_group(0 [pid 588] <... clone3 resumed> => {parent_tid=[595]}, 88) = 595 [pid 584] <... futex resumed>) = ? [pid 582] <... futex resumed>) = ? [pid 581] <... futex resumed>) = ? [pid 576] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 595 attached [pid 594] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 593] <... chdir resumed>) = 0 [pid 592] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 588] rt_sigprocmask(SIG_SETMASK, [], [pid 584] +++ exited with 0 +++ [pid 582] +++ exited with 0 +++ [pid 581] +++ exited with 0 +++ [pid 595] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 588] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 595] rt_sigprocmask(SIG_SETMASK, [], [pid 594] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 595] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] memfd_create("syzkaller", 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 588] <... futex resumed>) = 0 [pid 595] <... open resumed>) = 3 [pid 594] <... open resumed>) = 4 [pid 593] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 592] <... memfd_create resumed>) = 3 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] +++ exited with 0 +++ [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... prctl resumed>) = 0 [pid 592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 588] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] <... futex resumed>) = 1 [pid 593] setpgid(0, 0 [pid 592] <... mmap resumed>) = 0x7f0c41dcd000 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=569, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] <... setpgid resumed>) = 0 [pid 592] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] <... futex resumed>) = 0 [pid 588] <... futex resumed>) = 1 [pid 577] +++ exited with 0 +++ [pid 593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 592] <... write resumed>) = 262144 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 594] <... futex resumed>) = 0 [pid 593] <... openat resumed>) = 3 [pid 592] munmap(0x7f0c41dcd000, 138412032 [pid 589] <... futex resumed>) = 1 [pid 299] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=577, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 594] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 593] write(3, "1000", 4 [pid 592] <... munmap resumed>) = 0 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 594] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 593] <... write resumed>) = 4 [pid 592] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 593] close(3 [pid 592] <... openat resumed>) = 5 [pid 299] <... openat resumed>) = 3 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... close resumed>) = 0 [pid 592] ioctl(5, LOOP_SET_FD, 3 [pid 299] newfstatat(3, "", [pid 594] <... futex resumed>) = 1 [pid 593] symlink("/dev/binderfs", "./binderfs" [pid 589] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 595] <... futex resumed>) = 0 [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] <... symlink resumed>) = 0 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 589] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] <... mount resumed>) = 0 [pid 594] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 297] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 593] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] <... ioctl resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 592] close(3 [pid 588] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] newfstatat(3, "", [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 595] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 595] <... open resumed>) = 5 [pid 594] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [ 25.482170][ T581] EXT4-fs (loop0): get root inode failed [ 25.491956][ T591] loop2: detected capacity change from 0 to 512 [ 25.493179][ T581] EXT4-fs (loop0): mount failed [ 25.519132][ T592] loop1: detected capacity change from 0 to 512 [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 592] <... close resumed>) = 0 [pid 588] <... futex resumed>) = 0 [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] +++ exited with 0 +++ [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... rt_sigaction resumed>NULL, 8) = 0 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] mkdir("./file1", 0777 [pid 297] newfstatat(AT_FDCWD, "./9/bus", [pid 595] <... write resumed>) = 8 [pid 594] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 593] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 592] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=576, si_uid=0, si_status=0, si_utime=0, si_stime=23} --- [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./9/bus" [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 588] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 588] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./9/binderfs", [pid 595] <... write resumed>) = 1045 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./9/binderfs" [pid 595] <... futex resumed>) = 1 [pid 588] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./9/file1" [pid 593] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 591] <... mount resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./9/bus", [pid 297] <... rmdir resumed>) = 0 [pid 294] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 591] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... mprotect resumed>) = 0 [pid 591] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 299] unlink("./9/bus" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [pid 591] ioctl(4, LOOP_CLR_FD [pid 299] <... unlink resumed>) = 0 [pid 297] close(3 [pid 294] <... openat resumed>) = 3 [pid 593] <... rt_sigprocmask resumed>[], 8) = 0 [pid 591] <... ioctl resumed>) = 0 [pid 299] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 294] newfstatat(3, "", [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 591] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] rmdir("./9" [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 591] <... close resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./9/binderfs", [pid 297] <... rmdir resumed>) = 0 [pid 294] getdents64(3, [pid 593] <... clone3 resumed> => {parent_tid=[599]}, 88) = 599 [pid 591] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] exit_group(0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] mkdir("./10", 0777 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 595] <... futex resumed>) = ? [pid 593] rt_sigprocmask(SIG_SETMASK, [], [pid 591] <... futex resumed>) = ? [pid 588] <... exit_group resumed>) = ? [pid 299] unlink("./9/binderfs" [pid 294] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] +++ exited with 0 +++ [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 591] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 593] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] +++ exited with 0 +++ [pid 299] getdents64(3, [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 294] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=588, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] newfstatat(AT_FDCWD, "./9/bus", [pid 593] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [ 25.527553][ T591] EXT4-fs (loop2): 1 orphan inode deleted [ 25.534633][ T591] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.554187][ T591] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] rmdir("./9" [pid 296] <... restart_syscall resumed>) = 0 [pid 294] unlink("./9/bus" [pid 593] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... rmdir resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 294] <... unlink resumed>) = 0 [pid 593] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] mkdir("./10", 0777 [pid 294] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... mprotect resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 599 attached [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./9/binderfs", [pid 599] set_robust_list(0x7f0c4a20e9a0, 24 [pid 593] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... close resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] unlink("./9/binderfs" [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] newfstatat(3, "", [pid 294] <... unlink resumed>) = 0 [pid 593] <... clone3 resumed> => {parent_tid=[601]}, 88) = 601 [pid 299] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] newfstatat(AT_FDCWD, "./9/file1", [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 602 [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./9/file1" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... umount2 resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 599] <... set_robust_list resumed>) = 0 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(3, [pid 599] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 603 [pid 296] newfstatat(AT_FDCWD, "./9/bus", [pid 294] close(3 [pid 599] memfd_create("syzkaller", 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 599] <... memfd_create resumed>) = 3 [pid 296] unlink("./9/bus" [pid 294] rmdir("./9"./strace-static-x86_64: Process 602 attached [pid 599] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 601 attached [pid 602] set_robust_list(0x555556d8d6a0, 24 [pid 296] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] mkdir("./10", 0777 [pid 602] <... set_robust_list resumed>) = 0 [pid 601] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... mkdir resumed>) = 0 [pid 602] chdir("./10" [pid 601] <... set_robust_list resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./9/binderfs", [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 602] <... chdir resumed>) = 0 [pid 601] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... openat resumed>) = 3 [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./9/binderfs" [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 603 attached [pid 602] <... prctl resumed>) = 0 [pid 601] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 599] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... unlink resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 603] set_robust_list(0x555556d8d6a0, 24 [pid 602] setpgid(0, 0 [pid 601] <... open resumed>) = 4 [pid 599] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 604 [pid 603] <... set_robust_list resumed>) = 0 [pid 602] <... setpgid resumed>) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... write resumed>) = 262144 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 602] write(3, "1000", 4) = 4 [pid 603] chdir("./10" [pid 602] close(3 [pid 601] <... futex resumed>) = 1 [pid 599] munmap(0x7f0c41dcd000, 138412032 [pid 593] <... futex resumed>) = 0 [pid 603] <... chdir resumed>) = 0 [pid 602] <... close resumed>) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] <... munmap resumed>) = 0 [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 602] symlink("/dev/binderfs", "./binderfs" [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 599] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 593] <... futex resumed>) = 0 ./strace-static-x86_64: Process 604 attached [pid 603] <... prctl resumed>) = 0 [pid 602] <... symlink resumed>) = 0 [pid 601] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 599] <... openat resumed>) = 5 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] set_robust_list(0x555556d8d6a0, 24 [pid 603] setpgid(0, 0 [pid 602] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... mount resumed>) = 0 [ 25.586284][ T592] EXT4-fs (loop1): 1 orphan inode deleted [ 25.598276][ T592] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.609354][ T592] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 599] ioctl(5, LOOP_SET_FD, 3 [pid 604] <... set_robust_list resumed>) = 0 [pid 603] <... setpgid resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 604] chdir("./10" [pid 603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 602] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 601] <... futex resumed>) = 1 [pid 593] <... futex resumed>) = 0 [pid 604] <... chdir resumed>) = 0 [pid 603] <... openat resumed>) = 3 [pid 602] <... rt_sigaction resumed>NULL, 8) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] ioctl(5, LOOP_CLR_FD [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 603] write(3, "1000", 4 [pid 602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 604] <... prctl resumed>) = 0 [pid 603] <... write resumed>) = 4 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 599] <... ioctl resumed>) = 0 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] setpgid(0, 0 [pid 603] close(3 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... open resumed>) = 6 [pid 604] <... setpgid resumed>) = 0 [pid 603] <... close resumed>) = 0 [pid 602] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] close(3 [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 603] symlink("/dev/binderfs", "./binderfs" [pid 602] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 601] <... futex resumed>) = 1 [pid 599] <... close resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 604] <... openat resumed>) = 3 [pid 603] <... symlink resumed>) = 0 [pid 602] <... mprotect resumed>) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] mkdir("./bus", 0777 [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] write(3, "1000", 4 [pid 603] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 604] <... write resumed>) = 4 [pid 603] <... futex resumed>) = 0 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 601] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 599] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 604] close(3 [pid 603] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 601] <... write resumed>) = 8 [pid 604] <... close resumed>) = 0 [pid 603] <... rt_sigaction resumed>NULL, 8) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 605 attached [pid 604] symlink("/dev/binderfs", "./binderfs" [pid 603] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 602] <... clone3 resumed> => {parent_tid=[605]}, 88) = 605 [pid 601] <... futex resumed>) = 1 [pid 593] <... futex resumed>) = 0 [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... symlink resumed>) = 0 [pid 603] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 603] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 602] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 602] <... futex resumed>) = 0 [pid 601] <... write resumed>) = 1045 [pid 605] set_robust_list(0x7f0c4a20e9a0, 24 [pid 604] <... futex resumed>) = 0 [pid 605] <... set_robust_list resumed>) = 0 [pid 604] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 605] rt_sigprocmask(SIG_SETMASK, [], [pid 604] <... rt_sigaction resumed>NULL, 8) = 0 [pid 605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 604] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 605] memfd_create("syzkaller", 0 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] <... memfd_create resumed>) = 3 [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 605] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 604] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 604] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 603] <... mprotect resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... mmap resumed>) = 0x7f0c41dee000 [pid 604] <... mprotect resumed>) = 0 [pid 603] rt_sigprocmask(SIG_BLOCK, ~[], [pid 602] <... futex resumed>) = 0 [pid 601] <... futex resumed>) = 1 [pid 599] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... futex resumed>) = 0 [pid 604] rt_sigprocmask(SIG_BLOCK, ~[], [pid 603] <... rt_sigprocmask resumed>[], 8) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] ioctl(5, LOOP_CLR_FD [pid 604] <... rt_sigprocmask resumed>[], 8) = 0 [pid 603] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 602] <... mmap resumed>) = 0x7f0c41dcd000 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 602] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 599] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 606 attached [pid 603] <... clone3 resumed> => {parent_tid=[606]}, 88) = 606 [pid 602] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 607 attached [pid 606] set_robust_list(0x7f0c4a20e9a0, 24 [pid 605] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 604] <... clone3 resumed> => {parent_tid=[607]}, 88) = 607 [pid 603] rt_sigprocmask(SIG_SETMASK, [], [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 599] close(5 [pid 604] rt_sigprocmask(SIG_SETMASK, [], [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 599] <... close resumed>) = 0 [pid 603] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 599] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 604] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] <... futex resumed>) = 0 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... clone3 resumed> => {parent_tid=[608]}, 88) = 608 [pid 599] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 603] <... futex resumed>) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 296] newfstatat(AT_FDCWD, "./9/file1", [pid 603] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 603] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 602] <... futex resumed>) = 0 [pid 593] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 604] <... futex resumed>) = 0 [pid 603] <... mprotect resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 603] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... openat resumed>) = 4 [pid 603] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] newfstatat(4, "", [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 603] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 601] <... futex resumed>) = ? [pid 599] <... futex resumed>) = ? [pid 593] <... exit_group resumed>) = ? [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 604] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 601] +++ exited with 0 +++ [pid 599] +++ exited with 0 +++ [pid 592] <... ioctl resumed>) = 0 [pid 296] getdents64(4, [pid 603] <... clone3 resumed> => {parent_tid=[609]}, 88) = 609 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 604] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 603] rt_sigprocmask(SIG_SETMASK, [], [pid 592] close(5 [pid 296] getdents64(4, [pid 604] <... mprotect resumed>) = 0 [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 608 attached [pid 604] rt_sigprocmask(SIG_BLOCK, ~[], [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] exit_group(0 [pid 296] close(4 [pid 608] set_robust_list(0x7f0c41ded9a0, 24 [pid 604] <... rt_sigprocmask resumed>[], 8) = 0 [pid 603] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = ? [pid 592] <... futex resumed>) = ? [pid 589] <... exit_group resumed>) = ? [pid 296] <... close resumed>) = 0 ./strace-static-x86_64: Process 609 attached [pid 608] <... set_robust_list resumed>) = 0 [pid 607] set_robust_list(0x7f0c4a20e9a0, 24 [pid 606] <... set_robust_list resumed>) = 0 [pid 605] <... write resumed>) = 262144 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 594] +++ exited with 0 +++ [pid 592] +++ exited with 0 +++ [pid 589] +++ exited with 0 +++ [pid 296] rmdir("./9/file1" [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=589, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- ./strace-static-x86_64: Process 610 attached [pid 609] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 608] rt_sigprocmask(SIG_SETMASK, [], [pid 607] <... set_robust_list resumed>) = 0 [pid 606] rt_sigprocmask(SIG_SETMASK, [], [pid 605] munmap(0x7f0c41dee000, 138412032 [pid 610] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 609] <... set_robust_list resumed>) = 0 [pid 608] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] rt_sigprocmask(SIG_SETMASK, [], [pid 606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] <... munmap resumed>) = 0 [pid 604] <... clone3 resumed> => {parent_tid=[610]}, 88) = 610 [pid 296] <... rmdir resumed>) = 0 [pid 609] rt_sigprocmask(SIG_SETMASK, [], [pid 608] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 607] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 606] memfd_create("syzkaller", 0 [pid 605] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 604] rt_sigprocmask(SIG_SETMASK, [], [pid 296] getdents64(3, [pid 610] <... set_robust_list resumed>) = 0 [pid 609] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 608] <... open resumed>) = 4 [pid 607] memfd_create("syzkaller", 0 [pid 606] <... memfd_create resumed>) = 3 [pid 605] <... openat resumed>) = 5 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 609] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... memfd_create resumed>) = 3 [pid 606] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [ 25.632000][ T599] loop4: detected capacity change from 0 to 512 [ 25.646245][ T599] EXT4-fs (loop4): fragment/cluster size (0) != block size (4096) [pid 605] ioctl(5, LOOP_SET_FD, 3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 610] rt_sigprocmask(SIG_SETMASK, [], [pid 609] <... open resumed>) = 4 [pid 608] <... futex resumed>) = 1 [pid 607] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] <... mmap resumed>) = 0x7f0c41dcd000 [pid 602] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 610] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./9" [pid 295] <... openat resumed>) = 3 [pid 610] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] newfstatat(3, "", [pid 610] <... open resumed>) = 4 [pid 608] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] mkdir("./10", 0777 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... mount resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] getdents64(3, [pid 610] <... futex resumed>) = 0 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... futex resumed>) = 1 [pid 604] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... mmap resumed>) = 0x7f0c41dcd000 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 604] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] <... futex resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] newfstatat(AT_FDCWD, "./9/binderfs", [pid 608] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 610] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 296] <... close resumed>) = 0 [pid 295] unlink("./9/binderfs" [pid 610] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 606] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 605] <... ioctl resumed>) = 0 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... unlink resumed>) = 0 [pid 610] <... mount resumed>) = 0 [pid 609] <... futex resumed>) = 1 [pid 608] <... open resumed>) = 6 [pid 607] <... write resumed>) = 262144 [pid 605] close(3 [pid 603] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] munmap(0x7f0c41dcd000, 138412032 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... munmap resumed>) = 0 [pid 605] <... close resumed>) = 0 [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 609] <... futex resumed>) = 0 [pid 608] <... futex resumed>) = 1 [pid 607] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 605] mkdir("./bus", 0777 [pid 603] <... futex resumed>) = 1 [pid 602] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 611 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 609] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... openat resumed>) = 5 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... mount resumed>) = 0 [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] ioctl(5, LOOP_SET_FD, 3 [pid 605] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 602] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./9/file1", ./strace-static-x86_64: Process 611 attached [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 607] <... ioctl resumed>) = 0 [pid 606] <... write resumed>) = 262144 [pid 605] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 611] set_robust_list(0x555556d8d6a0, 24 [pid 610] <... futex resumed>) = 1 [pid 608] <... write resumed>) = 8 [pid 606] munmap(0x7f0c41dcd000, 138412032 [pid 604] <... futex resumed>) = 0 [pid 593] +++ exited with 0 +++ [pid 295] unlink("./9/file1" [pid 611] <... set_robust_list resumed>) = 0 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] <... munmap resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 611] chdir("./10" [pid 608] <... futex resumed>) = 1 [pid 606] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 602] <... futex resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=593, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] getdents64(3, [pid 611] <... chdir resumed>) = 0 [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] <... openat resumed>) = 5 [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 611] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 606] ioctl(5, LOOP_SET_FD, 3 [pid 602] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 611] <... prctl resumed>) = 0 [pid 609] <... futex resumed>) = 1 [pid 608] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... close resumed>) = 0 [pid 611] setpgid(0, 0 [pid 610] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... write resumed>) = 1045 [pid 606] <... ioctl resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 295] rmdir("./9" [pid 611] <... setpgid resumed>) = 0 [pid 610] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] close(3 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 295] <... rmdir resumed>) = 0 [pid 611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 610] <... open resumed>) = 6 [pid 608] <... futex resumed>) = 1 [pid 606] <... close resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] mkdir("./10", 0777 [pid 611] <... openat resumed>) = 3 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mkdir("./bus", 0777 [pid 604] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 295] <... mkdir resumed>) = 0 [pid 611] write(3, "1000", 4 [pid 610] <... futex resumed>) = 0 [pid 606] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 611] <... write resumed>) = 4 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 3 [pid 611] close(3 [pid 609] <... open resumed>) = 3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 611] <... close resumed>) = 0 [pid 610] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... futex resumed>) = 1 [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 611] symlink("/dev/binderfs", "./binderfs" [pid 610] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 609] <... futex resumed>) = 1 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 611] <... symlink resumed>) = 0 [pid 610] <... write resumed>) = 8 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./9/bus", [pid 295] <... close resumed>) = 0 [pid 611] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 611] <... futex resumed>) = 0 [pid 610] <... futex resumed>) = 1 [pid 609] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 604] <... futex resumed>) = 0 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./9/bus" [pid 611] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... write resumed>) = 8 [pid 607] close(3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 613 [pid 611] <... rt_sigaction resumed>NULL, 8) = 0 [pid 610] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... close resumed>) = 0 [pid 604] <... futex resumed>) = 0 [pid 298] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 611] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 610] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 609] <... futex resumed>) = 1 [pid 607] mkdir("./bus", 0777 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 610] <... write resumed>) = 1045 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./9/binderfs", ./strace-static-x86_64: Process 613 attached [pid 611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 603] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 611] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 610] <... futex resumed>) = 1 [pid 609] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 604] <... futex resumed>) = 0 [ 25.677979][ T605] loop5: detected capacity change from 0 to 512 [ 25.691516][ T607] loop0: detected capacity change from 0 to 512 [ 25.705288][ T606] loop3: detected capacity change from 0 to 512 [ 25.717229][ T605] EXT4-fs (loop5): Invalid log block size: 2475723007 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./9/binderfs" [pid 611] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... write resumed>) = 1045 [pid 298] <... unlink resumed>) = 0 [pid 611] <... mprotect resumed>) = 0 [pid 298] getdents64(3, [pid 611] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 611] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] close(3 [pid 611] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./9" [pid 611] <... clone3 resumed> => {parent_tid=[615]}, 88) = 615 [pid 298] <... rmdir resumed>) = 0 [pid 611] rt_sigprocmask(SIG_SETMASK, [], [pid 298] mkdir("./10", 0777 [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 611] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 611] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 611] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 611] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... close resumed>) = 0 [pid 611] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 609] <... futex resumed>) = 1 [pid 603] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 611] <... mprotect resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 611] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 616 ./strace-static-x86_64: Process 615 attached [pid 613] set_robust_list(0x555556d8d6a0, 24 [pid 611] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 616 attached [pid 615] set_robust_list(0x7f0c4a20e9a0, 24 [pid 613] <... set_robust_list resumed>) = 0 [pid 611] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 607] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 605] <... mount resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 617 attached [pid 616] set_robust_list(0x555556d8d6a0, 24 [pid 615] <... set_robust_list resumed>) = 0 [pid 613] chdir("./10" [pid 607] ioctl(5, LOOP_CLR_FD [pid 605] ioctl(5, LOOP_CLR_FD [pid 617] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 616] <... set_robust_list resumed>) = 0 [pid 615] rt_sigprocmask(SIG_SETMASK, [], [pid 613] <... chdir resumed>) = 0 [pid 611] <... clone3 resumed> => {parent_tid=[617]}, 88) = 617 [pid 607] <... ioctl resumed>) = 0 [pid 605] <... ioctl resumed>) = 0 [pid 617] <... set_robust_list resumed>) = 0 [pid 616] chdir("./10" [pid 615] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 613] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 611] rt_sigprocmask(SIG_SETMASK, [], [pid 607] close(5 [pid 605] close(5 [pid 616] <... chdir resumed>) = 0 [pid 615] memfd_create("syzkaller", 0 [pid 613] <... prctl resumed>) = 0 [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] <... close resumed>) = 0 [pid 615] <... memfd_create resumed>) = 3 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 611] <... futex resumed>) = 0 [pid 615] <... mmap resumed>) = 0x7f0c41dcd000 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 615] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 615] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 615] ioctl(4, LOOP_SET_FD, 3 [pid 616] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 613] setpgid(0, 0 [pid 607] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... close resumed>) = 0 [pid 616] <... prctl resumed>) = 0 [pid 613] <... setpgid resumed>) = 0 [pid 607] <... futex resumed>) = 0 [pid 605] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] exit_group(0 [pid 616] setpgid(0, 0 [pid 613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 604] <... exit_group resumed>) = ? [pid 610] <... futex resumed>) = ? [pid 605] <... futex resumed>) = 0 [pid 616] <... setpgid resumed>) = 0 [pid 613] <... openat resumed>) = 3 [pid 610] +++ exited with 0 +++ [pid 607] +++ exited with 0 +++ [pid 615] <... ioctl resumed>) = 0 [pid 615] close(3) = 0 [pid 615] mkdir("./file1", 0777 [pid 602] exit_group(0 [pid 608] <... futex resumed>) = ? [pid 602] <... exit_group resumed>) = ? [pid 616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 608] +++ exited with 0 +++ [pid 616] <... openat resumed>) = 3 [pid 613] write(3, "1000", 4 [pid 616] write(3, "1000", 4 [pid 615] <... mkdir resumed>) = 0 [pid 615] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 617] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 613] <... write resumed>) = 4 [pid 616] <... write resumed>) = 4 [pid 613] close(3 [pid 616] close(3 [pid 613] <... close resumed>) = 0 [pid 616] <... close resumed>) = 0 [pid 613] symlink("/dev/binderfs", "./binderfs" [pid 616] symlink("/dev/binderfs", "./binderfs" [pid 613] <... symlink resumed>) = 0 [pid 616] <... symlink resumed>) = 0 [pid 613] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 616] <... futex resumed>) = 0 [pid 613] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 616] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 613] <... rt_sigaction resumed>NULL, 8) = 0 [pid 616] <... rt_sigaction resumed>NULL, 8) = 0 [pid 613] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 616] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 613] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 616] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 613] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 616] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 613] <... mprotect resumed>) = 0 [pid 616] <... mprotect resumed>) = 0 [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [pid 616] rt_sigprocmask(SIG_BLOCK, ~[], [pid 613] <... rt_sigprocmask resumed>[], 8) = 0 [pid 616] <... rt_sigprocmask resumed>[], 8) = 0 [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 605] +++ exited with 0 +++ [pid 602] +++ exited with 0 +++ [pid 613] <... clone3 resumed> => {parent_tid=[618]}, 88) = 618 [pid 616] <... clone3 resumed> => {parent_tid=[619]}, 88) = 619 [pid 613] rt_sigprocmask(SIG_SETMASK, [], [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=602, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 616] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... restart_syscall resumed>) = 0 [pid 613] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 613] <... futex resumed>) = 0 [pid 299] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 616] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 613] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 616] <... mprotect resumed>) = 0 [pid 613] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 3 [pid 613] <... mprotect resumed>) = 0 [pid 299] newfstatat(3, "", [pid 616] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 613] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 616] <... clone3 resumed> => {parent_tid=[620]}, 88) = 620 [pid 613] <... clone3 resumed> => {parent_tid=[621]}, 88) = 621 [pid 616] rt_sigprocmask(SIG_SETMASK, [], [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 613] rt_sigprocmask(SIG_SETMASK, [], [pid 616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] <... futex resumed>) = 0 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./10/bus", [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./10/bus"./strace-static-x86_64: Process 621 attached ) = 0 [pid 299] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 617] <... write resumed>) = 8 [pid 299] newfstatat(AT_FDCWD, "./10/binderfs", [pid 621] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 25.735184][ T607] EXT4-fs (loop0): Invalid log block size: 2475723007 [ 25.747105][ T606] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.766909][ T615] loop2: detected capacity change from 0 to 512 [ 25.775643][ T606] EXT4-fs (loop3): get root inode failed [pid 299] unlink("./10/binderfs"./strace-static-x86_64: Process 620 attached ./strace-static-x86_64: Process 619 attached ./strace-static-x86_64: Process 618 attached [pid 617] <... futex resumed>) = 1 [pid 611] <... futex resumed>) = 0 [pid 604] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 621] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 619] set_robust_list(0x7f0c4a20e9a0, 24 [pid 618] set_robust_list(0x7f0c4a20e9a0, 24 [pid 617] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(3, [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=604, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 620] <... set_robust_list resumed>) = 0 [pid 620] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 620] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 619] <... set_robust_list resumed>) = 0 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] memfd_create("syzkaller", 0) = 4 [pid 618] <... set_robust_list resumed>) = 0 [pid 617] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 616] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 619] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 619] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 619] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 619] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 5 [pid 619] ioctl(5, LOOP_SET_FD, 4 [pid 621] <... futex resumed>) = 0 [pid 618] rt_sigprocmask(SIG_SETMASK, [], [pid 617] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 1 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] close(3 [pid 619] <... ioctl resumed>) = 0 [pid 619] close(4) = 0 [pid 619] mkdir("./file1", 0777) = 0 [pid 619] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 621] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 618] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 618] memfd_create("syzkaller", 0) = 4 [pid 618] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 618] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 618] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 618] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 5 [pid 618] ioctl(5, LOOP_SET_FD, 4 [pid 616] <... futex resumed>) = 1 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] ioctl(5, LOOP_CLR_FD [pid 299] <... close resumed>) = 0 [pid 294] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 620] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 606] <... ioctl resumed>) = 0 [pid 620] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] close(5 [pid 299] rmdir("./10" [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 620] <... mount resumed>) = 0 [pid 613] <... futex resumed>) = 1 [pid 621] <... futex resumed>) = 0 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 617] <... write resumed>) = 1045 [pid 615] <... mount resumed>) = 0 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 621] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 620] <... futex resumed>) = 1 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... futex resumed>) = 0 [pid 299] mkdir("./11", 0777 [pid 617] <... futex resumed>) = 1 [pid 294] <... openat resumed>) = 3 [pid 606] <... futex resumed>) = 0 [pid 611] <... futex resumed>) = 0 [pid 621] <... open resumed>) = 6 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] exit_group(0 [pid 617] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... mkdir resumed>) = 0 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 616] <... futex resumed>) = 0 [pid 609] <... futex resumed>) = ? [pid 603] <... exit_group resumed>) = ? [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 294] newfstatat(3, "", [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] +++ exited with 0 +++ [pid 606] +++ exited with 0 +++ [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 25.792907][ T606] EXT4-fs (loop3): mount failed [ 25.799501][ T615] EXT4-fs (loop2): 1 orphan inode deleted [ 25.805626][ T615] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.810298][ T619] loop4: detected capacity change from 0 to 512 [ 25.817956][ T615] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/10/file1 supports timestamps until 2038 (0x7fffffff) [pid 621] <... futex resumed>) = 1 [pid 620] <... open resumed>) = 4 [pid 613] <... futex resumed>) = 0 [pid 603] +++ exited with 0 +++ [pid 294] getdents64(3, [pid 615] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] <... ioctl resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=603, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 613] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 618] close(4 [pid 621] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 294] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 299] <... openat resumed>) = 3 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 616] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 297] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 621] <... write resumed>) = 8 [pid 620] <... write resumed>) = 8 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 618] <... close resumed>) = 0 [pid 618] mkdir("./file1", 0777) = 0 [pid 618] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 621] <... futex resumed>) = 1 [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 299] close(3 [pid 297] newfstatat(3, "", [pid 294] newfstatat(AT_FDCWD, "./10/bus", [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 621] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 620] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 294] unlink("./10/bus" [pid 621] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 620] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... unlink resumed>) = 0 [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] <... write resumed>) = 1045 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... write resumed>) = 1045 [pid 297] <... umount2 resumed>) = 0 [pid 621] <... futex resumed>) = 1 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 625 [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./10/bus", [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./10/binderfs", [pid 297] unlink("./10/bus" [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./10/binderfs") = 0 [pid 297] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] newfstatat(AT_FDCWD, "./10/binderfs", [pid 294] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 615] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 615] ioctl(4, LOOP_CLR_FD) = 0 [pid 615] close(4) = 0 [pid 615] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 625] chdir("./11") = 0 [pid 625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 625] setpgid(0, 0) = 0 [pid 625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 625] write(3, "1000", 4) = 4 [pid 625] close(3) = 0 [pid 625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 625] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 625] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 625] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 611] exit_group(0 [pid 297] unlink("./10/binderfs" [pid 294] rmdir("./10" [pid 617] <... futex resumed>) = ? [pid 615] <... futex resumed>) = ? [pid 611] <... exit_group resumed>) = ? [pid 617] +++ exited with 0 +++ [pid 297] <... unlink resumed>) = 0 [pid 625] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 294] mkdir("./11", 0777 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./10") = 0 [pid 297] mkdir("./11", 0777) = 0 [pid 618] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 615] +++ exited with 0 +++ [pid 611] +++ exited with 0 +++ [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=611, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 618] ioctl(5, LOOP_CLR_FD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 618] <... ioctl resumed>) = 0 [pid 296] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] close(3 [pid 618] close(5 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... close resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 618] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 618] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 627 [pid 618] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 618] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 613] exit_group(0 [pid 296] getdents64(3, [pid 625] <... mprotect resumed>) = 0 [pid 621] <... futex resumed>) = ? [pid 618] <... futex resumed>) = ? [ 25.841095][ T618] loop1: detected capacity change from 0 to 512 [ 25.859441][ T618] EXT4-fs (loop1): Invalid log block size: 2475723007 [pid 613] <... exit_group resumed>) = ? [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [pid 621] +++ exited with 0 +++ [pid 618] +++ exited with 0 +++ [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 627 attached [pid 625] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 627] set_robust_list(0x555556d8d6a0, 24 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 627] chdir("./11" [pid 625] <... clone3 resumed> => {parent_tid=[628]}, 88) = 628 [pid 296] newfstatat(AT_FDCWD, "./10/bus", [pid 627] <... chdir resumed>) = 0 [pid 625] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 627] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 625] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./10/bus" [pid 627] <... prctl resumed>) = 0 [pid 625] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 627] setpgid(0, 0 [pid 625] <... futex resumed>) = 0 [pid 296] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... setpgid resumed>) = 0 [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 625] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./10/binderfs", [pid 627] <... openat resumed>) = 3 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 627] write(3, "1000", 4 [pid 625] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] unlink("./10/binderfs" [pid 627] <... write resumed>) = 4 [pid 625] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... unlink resumed>) = 0 [pid 627] close(3 [pid 625] <... mprotect resumed>) = 0 [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... close resumed>) = 0 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [pid 627] symlink("/dev/binderfs", "./binderfs" [pid 625] <... rt_sigprocmask resumed>[], 8) = 0 [pid 627] <... symlink resumed>) = 0 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 627] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 625] <... clone3 resumed> => {parent_tid=[629]}, 88) = 629 [pid 627] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 625] rt_sigprocmask(SIG_SETMASK, [], [pid 627] <... rt_sigaction resumed>NULL, 8) = 0 [pid 625] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... openat resumed>) = 3 [pid 627] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 625] <... futex resumed>) = 0 [pid 627] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 627] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 627] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 627] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[630]}, 88) = 630 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] ioctl(3, LOOP_CLR_FD [pid 627] <... futex resumed>) = 0 [pid 627] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 627] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 627] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] close(3 [pid 627] <... mprotect resumed>) = 0 [pid 627] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 297] <... close resumed>) = 0 [pid 627] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 627] <... clone3 resumed> => {parent_tid=[631]}, 88) = 631 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 632 attached [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 632 [pid 632] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 632] chdir("./11") = 0 [pid 632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 632] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 628 attached [pid 632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 632] write(3, "1000", 4) = 4 [pid 632] close(3) = 0 [pid 632] symlink("/dev/binderfs", "./binderfs") = 0 [pid 632] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 632] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 632] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[633]}, 88) = 633 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 632] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[634]}, 88) = 634 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 633 attached [pid 633] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 633] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 633] memfd_create("syzkaller", 0) = 3 [pid 633] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 634 attached ./strace-static-x86_64: Process 631 attached ./strace-static-x86_64: Process 630 attached ./strace-static-x86_64: Process 629 attached [pid 628] set_robust_list(0x7f0c4a20e9a0, 24 [pid 613] +++ exited with 0 +++ [pid 634] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 633] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 631] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 630] set_robust_list(0x7f0c4a20e9a0, 24 [pid 629] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 628] <... set_robust_list resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=613, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 631] <... set_robust_list resumed>) = 0 [pid 630] <... set_robust_list resumed>) = 0 [pid 629] <... set_robust_list resumed>) = 0 [pid 628] rt_sigprocmask(SIG_SETMASK, [], [pid 631] rt_sigprocmask(SIG_SETMASK, [], [pid 630] rt_sigprocmask(SIG_SETMASK, [], [pid 629] rt_sigprocmask(SIG_SETMASK, [], [pid 628] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 631] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 630] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 629] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 628] memfd_create("syzkaller", 0 [pid 631] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 630] memfd_create("syzkaller", 0 [pid 629] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 628] <... memfd_create resumed>) = 3 [pid 631] <... open resumed>) = 4 [pid 630] <... memfd_create resumed>) = 3 [pid 629] <... open resumed>) = 4 [pid 628] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... mmap resumed>) = 0x7f0c41dcd000 [pid 631] <... futex resumed>) = 1 [pid 630] <... mmap resumed>) = 0x7f0c41dcd000 [pid 629] <... futex resumed>) = 1 [pid 628] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] <... write resumed>) = 262144 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 630] <... write resumed>) = 262144 [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] munmap(0x7f0c41dcd000, 138412032 [pid 634] <... set_robust_list resumed>) = 0 [pid 631] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 630] munmap(0x7f0c41dcd000, 138412032 [pid 629] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 628] <... munmap resumed>) = 0 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 634] rt_sigprocmask(SIG_SETMASK, [], [pid 631] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 630] <... munmap resumed>) = 0 [pid 629] <... mount resumed>) = 0 [pid 628] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 634] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... openat resumed>) = 5 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 634] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 631] <... futex resumed>) = 0 [pid 630] <... openat resumed>) = 5 [pid 629] <... futex resumed>) = 0 [pid 628] ioctl(5, LOOP_SET_FD, 3 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... umount2 resumed>) = 0 [pid 295] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] <... open resumed>) = 4 [pid 633] <... write resumed>) = 262144 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] ioctl(5, LOOP_SET_FD, 3 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] ioctl(5, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 633] munmap(0x7f0c41dcd000, 138412032 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 629] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 619] <... ioctl resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./10/file1", [pid 295] newfstatat(3, "", [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 633] <... munmap resumed>) = 0 [pid 632] <... futex resumed>) = 0 [pid 619] close(5 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 25.881354][ T619] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.895769][ T619] EXT4-fs (loop4): get root inode failed [ 25.905379][ T619] EXT4-fs (loop4): mount failed [ 25.932702][ T628] loop5: detected capacity change from 0 to 512 [pid 634] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 633] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 634] <... mount resumed>) = 0 [pid 633] <... openat resumed>) = 5 [pid 619] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] ioctl(5, LOOP_SET_FD, 3 [pid 631] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 619] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] <... ioctl resumed>) = 0 [pid 629] <... open resumed>) = 6 [pid 628] <... ioctl resumed>) = 0 [pid 619] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 631] <... futex resumed>) = 1 [pid 630] close(3 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] close(3 [pid 616] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] <... close resumed>) = 0 [pid 629] <... futex resumed>) = 1 [pid 628] <... close resumed>) = 0 [pid 620] <... futex resumed>) = ? [pid 616] <... exit_group resumed>) = ? [pid 296] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 630] mkdir("./file1", 0777 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] mkdir("./bus", 0777 [pid 620] +++ exited with 0 +++ [pid 296] <... openat resumed>) = 4 [pid 630] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 628] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 296] newfstatat(4, "", [pid 630] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 628] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 634] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 633] <... ioctl resumed>) = 0 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 619] <... futex resumed>) = ? [pid 296] getdents64(4, [pid 295] <... umount2 resumed>) = 0 [pid 634] <... open resumed>) = 6 [pid 632] <... futex resumed>) = 0 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./10/file1" [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 631] <... futex resumed>) = 0 [pid 629] <... futex resumed>) = 0 [pid 627] <... futex resumed>) = 1 [pid 625] <... futex resumed>) = 1 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 631] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 629] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 296] getdents64(3, [pid 631] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... write resumed>) = 8 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 634] <... futex resumed>) = 0 [pid 632] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 295] newfstatat(AT_FDCWD, "./10/bus", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 629] <... futex resumed>) = 0 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... close resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 632] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./10" [pid 295] unlink("./10/bus" [pid 634] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 633] close(3 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 634] <... write resumed>) = 8 [pid 633] <... close resumed>) = 0 [pid 631] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 629] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] mkdir("./bus", 0777 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] <... futex resumed>) = 1 [pid 633] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 632] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./10/binderfs", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 633] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 632] <... futex resumed>) = 0 [pid 631] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... write resumed>) = 1045 [pid 296] mkdir("./11", 0777 [pid 295] unlink("./10/binderfs" [pid 634] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 634] <... write resumed>) = 1045 [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./10/file1", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./10/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./10") = 0 [pid 295] mkdir("./11", 0777 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] +++ exited with 0 +++ [pid 616] +++ exited with 0 +++ [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 631] <... futex resumed>) = 1 [pid 629] <... futex resumed>) = 1 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=616, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [ 25.941114][ T630] loop0: detected capacity change from 0 to 512 [ 25.949131][ T633] loop3: detected capacity change from 0 to 512 [ 25.963940][ T630] EXT4-fs (loop0): 1 orphan inode deleted [ 25.970489][ T630] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.981718][ T630] ext4 filesystem being mounted at /root/syzkaller.iF59aB/11/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 298] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] close(3 [pid 295] close(3 [pid 298] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 642 attached ./strace-static-x86_64: Process 641 attached [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 642] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 642] chdir("./11") = 0 [pid 642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 642] setpgid(0, 0) = 0 [pid 642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 642] write(3, "1000", 4) = 4 [pid 642] close(3) = 0 [pid 642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 642] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] set_robust_list(0x555556d8d6a0, 24 [pid 298] getdents64(3, [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 641 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 642 [pid 642] <... futex resumed>) = 0 [pid 642] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 641] <... set_robust_list resumed>) = 0 [pid 642] <... rt_sigaction resumed>NULL, 8) = 0 [pid 641] chdir("./11" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 641] <... chdir resumed>) = 0 [pid 642] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 641] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 630] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] <... prctl resumed>) = 0 [pid 642] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 641] setpgid(0, 0 [pid 630] ioctl(5, LOOP_CLR_FD [pid 641] <... setpgid resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 628] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 642] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 641] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 633] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 628] ioctl(5, LOOP_CLR_FD [pid 642] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 641] write(3, "1000", 4 [pid 298] newfstatat(AT_FDCWD, "./10/bus", [pid 642] <... mprotect resumed>) = 0 [pid 641] <... write resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[], [pid 641] close(3 [pid 298] unlink("./10/bus" [pid 642] <... rt_sigprocmask resumed>[], 8) = 0 [pid 641] <... close resumed>) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 641] symlink("/dev/binderfs", "./binderfs" [pid 298] <... unlink resumed>) = 0 [pid 642] <... clone3 resumed> => {parent_tid=[643]}, 88) = 643 [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] <... symlink resumed>) = 0 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 642] <... futex resumed>) = 0 [pid 641] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 641] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] newfstatat(AT_FDCWD, "./10/binderfs", [pid 642] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 641] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 643 attached [pid 642] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 633] ioctl(5, LOOP_CLR_FD [pid 628] <... ioctl resumed>) = 0 [pid 642] <... mprotect resumed>) = 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 641] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 642] <... clone3 resumed> => {parent_tid=[644]}, 88) = 644 [pid 298] unlink("./10/binderfs" [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... ioctl resumed>) = 0 [pid 633] close(5./strace-static-x86_64: Process 644 attached [pid 643] set_robust_list(0x7f0c4a20e9a0, 24 [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 633] <... close resumed>) = 0 [pid 628] close(5 [pid 298] <... unlink resumed>) = 0 [pid 644] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 643] <... set_robust_list resumed>) = 0 [pid 641] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 628] <... close resumed>) = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 644] <... set_robust_list resumed>) = 0 [pid 643] rt_sigprocmask(SIG_SETMASK, [], [pid 641] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 628] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 644] rt_sigprocmask(SIG_SETMASK, [], [pid 643] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 641] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 633] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] <... futex resumed>) = ? [pid 628] <... futex resumed>) = ? [pid 625] <... exit_group resumed>) = ? [pid 298] newfstatat(AT_FDCWD, "./10/file1", [pid 644] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 643] memfd_create("syzkaller", 0 [pid 641] <... mprotect resumed>) = 0 [pid 633] <... futex resumed>) = 0 [pid 632] exit_group(0 [pid 629] +++ exited with 0 +++ [pid 628] +++ exited with 0 +++ [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 644] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 643] <... memfd_create resumed>) = 3 [pid 641] rt_sigprocmask(SIG_BLOCK, ~[], [pid 634] <... futex resumed>) = ? [pid 632] <... exit_group resumed>) = ? [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 644] <... open resumed>) = 4 [pid 643] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 641] <... rt_sigprocmask resumed>[], 8) = 0 [pid 634] +++ exited with 0 +++ [pid 633] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... mmap resumed>) = 0x7f0c41dcd000 [pid 641] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 645 attached [pid 644] <... futex resumed>) = 1 [pid 643] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 642] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 645] set_robust_list(0x7f0c4a20e9a0, 24 [pid 644] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... clone3 resumed> => {parent_tid=[645]}, 88) = 645 [pid 298] newfstatat(4, "", [pid 645] <... set_robust_list resumed>) = 0 [pid 644] <... mount resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 645] rt_sigprocmask(SIG_SETMASK, [], [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... write resumed>) = 262144 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(4, [pid 644] <... futex resumed>) = 0 [pid 643] munmap(0x7f0c41dcd000, 138412032 [pid 642] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 641] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... munmap resumed>) = 0 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 642] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 645] memfd_create("syzkaller", 0 [pid 644] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 643] <... openat resumed>) = 5 [pid 645] <... memfd_create resumed>) = 3 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 645] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 644] <... open resumed>) = 6 [pid 643] ioctl(5, LOOP_SET_FD, 3 [pid 641] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] close(4 [pid 645] <... mmap resumed>) = 0x7f0c41dee000 [ 25.994015][ T628] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.008885][ T633] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.009427][ T628] EXT4-fs (loop5): get root inode failed [ 26.023357][ T633] EXT4-fs (loop3): get root inode failed [ 26.027838][ T628] EXT4-fs (loop5): mount failed [ 26.034819][ T633] EXT4-fs (loop3): mount failed [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... mmap resumed>) = 0x7f0c41dcd000 [pid 298] <... close resumed>) = 0 [pid 645] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 644] <... futex resumed>) = 1 [pid 643] <... ioctl resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 298] rmdir("./10/file1" [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] close(3 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... mprotect resumed>) = 0 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] <... close resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... rmdir resumed>) = 0 [pid 644] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 643] mkdir("./bus", 0777 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] getdents64(3, [pid 645] <... write resumed>) = 262144 [pid 643] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 641] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 641] <... clone3 resumed> => {parent_tid=[646]}, 88) = 646 [pid 298] <... close resumed>) = 0 [pid 641] rt_sigprocmask(SIG_SETMASK, [], [pid 298] rmdir("./10" [pid 644] <... write resumed>) = 8 [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 645] munmap(0x7f0c41dee000, 138412032 [pid 643] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 646 attached [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 646] set_robust_list(0x7f0c41ded9a0, 24 [pid 645] <... munmap resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 642] <... futex resumed>) = 0 [pid 641] <... futex resumed>) = 0 [pid 298] mkdir("./11", 0777 [pid 645] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... openat resumed>) = 4 [pid 642] <... futex resumed>) = 0 [pid 645] ioctl(4, LOOP_SET_FD, 3 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... mkdir resumed>) = 0 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 644] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] <... openat resumed>) = 3 [pid 645] <... ioctl resumed>) = 0 [pid 644] <... write resumed>) = 1045 [pid 298] ioctl(3, LOOP_CLR_FD [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 644] <... futex resumed>) = 1 [pid 298] close(3 [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 642] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 645] close(3) = 0 [pid 645] mkdir("./file1", 0777 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 648 [pid 646] <... set_robust_list resumed>) = 0 [pid 646] rt_sigprocmask(SIG_SETMASK, [], [pid 645] <... mkdir resumed>) = 0 [pid 645] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 646] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 646] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 648 attached [pid 630] <... ioctl resumed>) = 0 [pid 648] set_robust_list(0x555556d8d6a0, 24 [pid 646] <... mount resumed>) = 0 [pid 630] close(5 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] <... futex resumed>) = 1 [pid 646] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] <... futex resumed>) = 1 [pid 646] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 630] <... close resumed>) = 0 [pid 630] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] <... set_robust_list resumed>) = 0 [pid 627] exit_group(0 [pid 631] <... futex resumed>) = ? [pid 630] <... futex resumed>) = ? [pid 627] <... exit_group resumed>) = ? [pid 631] +++ exited with 0 +++ [pid 630] +++ exited with 0 +++ [pid 627] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=627, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 625] +++ exited with 0 +++ [pid 294] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 648] chdir("./11" [pid 294] unlink("./11/binderfs" [pid 648] <... chdir resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 648] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 294] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 648] <... prctl resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 648] setpgid(0, 0 [pid 294] newfstatat(AT_FDCWD, "./11/file1", [pid 648] <... setpgid resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] unlink("./11/file1" [pid 648] <... openat resumed>) = 3 [pid 294] <... unlink resumed>) = 0 [pid 648] write(3, "1000", 4 [pid 294] getdents64(3, [pid 648] <... write resumed>) = 4 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 648] close(3 [pid 294] close(3 [pid 648] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 648] symlink("/dev/binderfs", "./binderfs" [ 26.067546][ T643] loop1: detected capacity change from 0 to 512 [ 26.078869][ T645] loop2: detected capacity change from 0 to 512 [ 26.091102][ T643] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.109160][ T643] EXT4-fs (loop1): get root inode failed [pid 294] rmdir("./11" [pid 648] <... symlink resumed>) = 0 [pid 646] <... write resumed>) = 8 [pid 632] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=625, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... rmdir resumed>) = 0 [pid 648] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=632, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] mkdir("./12", 0777 [pid 648] <... futex resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 643] ioctl(5, LOOP_CLR_FD [pid 641] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 648] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 646] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... ioctl resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 648] <... rt_sigaction resumed>NULL, 8) = 0 [pid 646] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] close(5 [pid 641] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 643] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 643] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 643] <... futex resumed>) = 0 [pid 299] newfstatat(3, "", [pid 643] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 642] exit_group(0 [pid 299] getdents64(3, [pid 643] <... futex resumed>) = ? [pid 642] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 643] +++ exited with 0 +++ [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 648] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 646] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... openat resumed>) = 3 [pid 644] <... futex resumed>) = ? [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 648] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 648] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 648] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 648] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 648] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[652]}, 88) = 652 [pid 648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 648] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 648] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 648] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 648] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[653]}, 88) = 653 [pid 648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 653 attached ./strace-static-x86_64: Process 652 attached [pid 646] <... write resumed>) = 1045 [pid 645] <... mount resumed>) = 0 [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 653] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 652] set_robust_list(0x7f0c4a20e9a0, 24 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 294] close(3 [pid 653] <... set_robust_list resumed>) = 0 [pid 652] <... set_robust_list resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 645] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 641] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./11/bus", [pid 297] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 653] rt_sigprocmask(SIG_SETMASK, [], [pid 652] rt_sigprocmask(SIG_SETMASK, [], [pid 646] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 645] ioctl(4, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 653] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 652] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 645] <... ioctl resumed>) = 0 [pid 299] unlink("./11/bus" [pid 297] getdents64(3, ./strace-static-x86_64: Process 654 attached [pid 653] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 652] memfd_create("syzkaller", 0 [pid 645] close(4 [pid 299] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 654 [pid 654] set_robust_list(0x555556d8d6a0, 24 [pid 653] <... open resumed>) = 3 [pid 652] <... memfd_create resumed>) = 4 [pid 645] <... close resumed>) = 0 [pid 299] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] <... set_robust_list resumed>) = 0 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 645] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] <... mmap resumed>) = 0x7f0c41dcd000 [pid 648] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./11/binderfs", [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] chdir("./12" [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... chdir resumed>) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] <... write resumed>) = 262144 [pid 648] <... futex resumed>) = 0 [pid 299] unlink("./11/binderfs" [pid 297] newfstatat(AT_FDCWD, "./11/bus", [pid 654] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 653] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 652] munmap(0x7f0c41dcd000, 138412032 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] exit_group(0 [pid 299] <... unlink resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 654] <... prctl resumed>) = 0 [pid 653] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 652] <... munmap resumed>) = 0 [pid 646] <... futex resumed>) = ? [pid 645] <... futex resumed>) = ? [pid 641] <... exit_group resumed>) = ? [pid 299] getdents64(3, [pid 297] unlink("./11/bus" [pid 654] setpgid(0, 0 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 646] +++ exited with 0 +++ [pid 645] +++ exited with 0 +++ [pid 644] +++ exited with 0 +++ [pid 642] +++ exited with 0 +++ [pid 641] +++ exited with 0 +++ [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 [pid 654] <... setpgid resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] <... openat resumed>) = 5 [pid 648] <... futex resumed>) = 0 [pid 299] close(3 [pid 297] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 26.114668][ T643] EXT4-fs (loop1): mount failed [ 26.123251][ T645] EXT4-fs (loop2): 1 orphan inode deleted [ 26.134950][ T645] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.146545][ T645] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/11/file1 supports timestamps until 2038 (0x7fffffff) [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] ioctl(5, LOOP_SET_FD, 4 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=642, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 654] <... openat resumed>) = 3 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 648] <... futex resumed>) = 0 [pid 299] rmdir("./11" [pid 297] newfstatat(AT_FDCWD, "./11/binderfs", [pid 295] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] write(3, "1000", 4 [pid 653] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 652] <... ioctl resumed>) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=641, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... write resumed>) = 4 [pid 653] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 652] close(4 [pid 299] mkdir("./12", 0777 [pid 297] unlink("./11/binderfs" [pid 296] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 654] close(3 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 654] <... close resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] mkdir("./file1", 0777 [pid 648] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] getdents64(3, [pid 296] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] newfstatat(3, "", [pid 654] symlink("/dev/binderfs", "./binderfs" [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 654] <... symlink resumed>) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 648] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 296] newfstatat(3, "", [pid 295] getdents64(3, [pid 654] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 654] <... futex resumed>) = 0 [pid 653] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 299] close(3 [pid 297] rmdir("./11" [pid 296] getdents64(3, [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... umount2 resumed>) = 0 [pid 654] <... rt_sigaction resumed>NULL, 8) = 0 [pid 653] <... futex resumed>) = 1 [pid 648] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] mkdir("./12", 0777 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 648] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 655 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./11/bus", [pid 654] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 653] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 654] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 653] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] newfstatat(AT_FDCWD, "./11/bus", [pid 295] unlink("./11/bus" [pid 654] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 654] <... mprotect resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 648] <... futex resumed>) = 0 [pid 297] close(3 [pid 296] unlink("./11/bus" [pid 295] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigprocmask(SIG_BLOCK, ~[], [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./11/binderfs", [pid 654] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 656 [pid 296] newfstatat(AT_FDCWD, "./11/binderfs", [pid 295] unlink("./11/binderfs" [pid 654] <... clone3 resumed> => {parent_tid=[657]}, 88) = 657 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 654] rt_sigprocmask(SIG_SETMASK, [], [pid 296] unlink("./11/binderfs" [pid 295] getdents64(3, [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 654] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 654] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 ./strace-static-x86_64: Process 655 attached [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] rmdir("./11" [pid 655] set_robust_list(0x555556d8d6a0, 24 [pid 654] <... futex resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 655] <... set_robust_list resumed>) = 0 [pid 654] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] mkdir("./12", 0777 [pid 655] chdir("./12" [pid 654] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] <... mkdir resumed>) = 0 [pid 655] <... chdir resumed>) = 0 [pid 654] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 655] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 654] <... mprotect resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 655] <... prctl resumed>) = 0 [pid 654] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] ioctl(3, LOOP_CLR_FD [pid 655] setpgid(0, 0 [pid 654] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 655] <... setpgid resumed>) = 0 [pid 654] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] close(3 [pid 655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... close resumed>) = 0 ./strace-static-x86_64: Process 657 attached [pid 655] <... openat resumed>) = 3 [pid 654] <... clone3 resumed> => {parent_tid=[660]}, 88) = 660 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 661 attached ./strace-static-x86_64: Process 660 attached ./strace-static-x86_64: Process 656 attached [pid 657] set_robust_list(0x7f0c4a20e9a0, 24 [pid 655] write(3, "1000", 4 [pid 654] rt_sigprocmask(SIG_SETMASK, [], [pid 657] <... set_robust_list resumed>) = 0 [pid 656] set_robust_list(0x555556d8d6a0, 24 [pid 655] <... write resumed>) = 4 [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 661 [pid 657] rt_sigprocmask(SIG_SETMASK, [], [pid 656] <... set_robust_list resumed>) = 0 [pid 655] close(3 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 656] chdir("./12" [pid 655] <... close resumed>) = 0 [pid 654] <... futex resumed>) = 0 [pid 657] memfd_create("syzkaller", 0 [pid 656] <... chdir resumed>) = 0 [pid 655] symlink("/dev/binderfs", "./binderfs" [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] set_robust_list(0x555556d8d6a0, 24 [pid 660] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 657] <... memfd_create resumed>) = 3 [pid 656] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 655] <... symlink resumed>) = 0 [pid 661] <... set_robust_list resumed>) = 0 [pid 660] <... set_robust_list resumed>) = 0 [pid 661] chdir("./12" [pid 660] rt_sigprocmask(SIG_SETMASK, [], [pid 661] <... chdir resumed>) = 0 [pid 660] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 661] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 660] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 661] <... prctl resumed>) = 0 [pid 660] <... open resumed>) = 4 [pid 661] setpgid(0, 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... setpgid resumed>) = 0 [ 26.173316][ T652] loop4: detected capacity change from 0 to 512 [ 26.206456][ T652] EXT4-fs (loop4): 1 orphan inode deleted [pid 660] <... futex resumed>) = 0 [pid 661] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 661] <... openat resumed>) = 3 [pid 657] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 655] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 661] write(3, "1000", 4 [pid 656] <... prctl resumed>) = 0 [pid 661] <... write resumed>) = 4 [pid 661] close(3) = 0 [pid 661] symlink("/dev/binderfs", "./binderfs") = 0 [pid 661] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 661] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 661] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] newfstatat(AT_FDCWD, "./11/file1", [pid 661] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 661] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 661] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 661] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 657] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... openat resumed>) = 4 [pid 655] <... futex resumed>) = 0 [pid 661] <... mprotect resumed>) = 0 [pid 656] setpgid(0, 0 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(4, "", [pid 661] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 661] <... rt_sigprocmask resumed>[], 8) = 0 [pid 660] <... futex resumed>) = 0 [pid 657] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 656] <... setpgid resumed>) = 0 [pid 655] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 654] <... futex resumed>) = 1 [pid 296] getdents64(4, [pid 661] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 660] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 657] <... write resumed>) = 262144 [pid 656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 655] <... rt_sigaction resumed>NULL, 8) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 657] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 657] ioctl(5, LOOP_SET_FD, 3 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 662 attached [pid 660] <... mount resumed>) = 0 [pid 656] <... openat resumed>) = 3 [pid 655] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] getdents64(4, [pid 662] set_robust_list(0x7f0c4a20e9a0, 24 [pid 661] <... clone3 resumed> => {parent_tid=[662]}, 88) = 662 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] write(3, "1000", 4 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 662] <... set_robust_list resumed>) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], [pid 660] <... futex resumed>) = 1 [pid 656] <... write resumed>) = 4 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 654] <... futex resumed>) = 0 [pid 296] close(4 [pid 662] rt_sigprocmask(SIG_SETMASK, [], [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] close(3 [pid 655] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 657] <... ioctl resumed>) = 0 [pid 657] close(3 [pid 661] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... close resumed>) = 0 [pid 655] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 654] <... futex resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] rmdir("./11/file1" [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 656] symlink("/dev/binderfs", "./binderfs" [pid 655] <... mprotect resumed>) = 0 [pid 657] <... close resumed>) = 0 [pid 657] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 657] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... rmdir resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 660] <... open resumed>) = 3 [pid 656] <... symlink resumed>) = 0 [pid 661] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] getdents64(3, [pid 656] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 660] <... futex resumed>) = 1 [pid 655] <... rt_sigprocmask resumed>[], 8) = 0 [pid 654] <... futex resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 661] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] close(3 [pid 661] <... mprotect resumed>) = 0 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 654] <... futex resumed>) = 0 [pid 656] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] <... close resumed>) = 0 [pid 661] rt_sigprocmask(SIG_BLOCK, ~[], [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 660] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 655] <... clone3 resumed> => {parent_tid=[663]}, 88) = 663 [pid 656] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] rmdir("./11" [pid 661] <... rt_sigprocmask resumed>[], 8) = 0 [pid 662] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 662] memfd_create("syzkaller", 0 [pid 661] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 660] <... write resumed>) = 8 [pid 656] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 655] rt_sigprocmask(SIG_SETMASK, [], [pid 662] <... memfd_create resumed>) = 3 [pid 662] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... rmdir resumed>) = 0 [pid 662] <... mmap resumed>) = 0x7f0c41dcd000 [pid 662] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] mkdir("./12", 0777 [pid 662] <... write resumed>) = 262144 [pid 662] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 662] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 662] ioctl(4, LOOP_SET_FD, 3 [pid 661] <... clone3 resumed> => {parent_tid=[664]}, 88) = 664 [pid 660] <... futex resumed>) = 1 [pid 656] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 655] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 655] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... mprotect resumed>) = 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 662] <... ioctl resumed>) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [pid 655] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 662] close(3) = 0 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 661] <... futex resumed>) = 0 [pid 655] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 662] mkdir("./file1", 0777 [pid 655] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 660] <... write resumed>) = 1045 [pid 656] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... openat resumed>) = 3 [pid 655] <... mprotect resumed>) = 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] ioctl(3, LOOP_CLR_FD [pid 660] <... futex resumed>) = 1 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[], [pid 654] <... futex resumed>) = 0 [pid 655] <... rt_sigprocmask resumed>[], 8) = 0 [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] <... clone3 resumed> => {parent_tid=[665]}, 88) = 665 [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] <... clone3 resumed> => {parent_tid=[666]}, 88) = 666 [pid 296] close(3 [pid 656] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... close resumed>) = 0 [pid 662] <... mkdir resumed>) = 0 [pid 662] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 665 attached [pid 665] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] memfd_create("syzkaller", 0) = 3 [pid 665] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 665] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 665] munmap(0x7f0c41dee000, 138412032) = 0 [pid 665] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 26.213981][ T652] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.225687][ T652] ext4 filesystem being mounted at /root/syzkaller.qPQybd/11/file1 supports timestamps until 2038 (0x7fffffff) [ 26.240970][ T657] loop0: detected capacity change from 0 to 512 [ 26.253604][ T662] loop1: detected capacity change from 0 to 512 [ 26.266230][ T665] loop3: detected capacity change from 0 to 512 [pid 665] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 666 attached ./strace-static-x86_64: Process 664 attached ./strace-static-x86_64: Process 663 attached [pid 656] <... futex resumed>) = 0 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 667 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 656] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 656] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[668]}, 88) = 668 [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 665] <... ioctl resumed>) = 0 [pid 652] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 652] ioctl(5, LOOP_CLR_FD [pid 664] <... set_robust_list resumed>) = 0 [pid 664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 664] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 663] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 663] memfd_create("syzkaller", 0) = 3 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... futex resumed>) = 0 [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 663] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 666] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] <... mmap resumed>) = 0x7f0c41dcd000 [pid 666] <... set_robust_list resumed>) = 0 [pid 664] <... futex resumed>) = 1 [pid 661] <... futex resumed>) = 0 [pid 666] rt_sigprocmask(SIG_SETMASK, [], [pid 664] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 664] <... open resumed>) = 5 [pid 663] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 661] <... futex resumed>) = 0 [pid 666] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] <... open resumed>) = 4 [pid 665] close(3 [pid 664] <... futex resumed>) = 0 [pid 661] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 668 attached ./strace-static-x86_64: Process 667 attached [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 664] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 663] <... write resumed>) = 262144 [pid 668] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 667] set_robust_list(0x555556d8d6a0, 24 [pid 666] <... futex resumed>) = 1 [pid 664] <... write resumed>) = 8 [pid 655] <... futex resumed>) = 0 [pid 668] <... set_robust_list resumed>) = 0 [pid 667] <... set_robust_list resumed>) = 0 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] <... close resumed>) = 0 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] munmap(0x7f0c41dcd000, 138412032 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] rt_sigprocmask(SIG_SETMASK, [], [pid 667] chdir("./12" [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 664] <... futex resumed>) = 1 [pid 663] <... munmap resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 668] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 667] <... chdir resumed>) = 0 [pid 666] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 664] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 663] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 667] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 666] <... mount resumed>) = 0 [pid 664] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 663] <... openat resumed>) = 5 [pid 661] <... futex resumed>) = 0 [pid 668] <... open resumed>) = 3 [pid 667] <... prctl resumed>) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] mkdir("./bus", 0777 [pid 664] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 663] ioctl(5, LOOP_SET_FD, 3 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] setpgid(0, 0 [pid 666] <... futex resumed>) = 1 [pid 655] <... futex resumed>) = 0 [pid 652] <... ioctl resumed>) = 0 [pid 668] <... futex resumed>) = 1 [pid 667] <... setpgid resumed>) = 0 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] <... futex resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] <... futex resumed>) = 0 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... openat resumed>) = 3 [pid 666] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 656] <... futex resumed>) = 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 667] write(3, "1000", 4 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... mount resumed>) = 0 [pid 667] <... write resumed>) = 4 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] close(3 [pid 668] <... futex resumed>) = 1 [pid 667] <... close resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] symlink("/dev/binderfs", "./binderfs" [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... symlink resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 667] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... open resumed>) = 5 [pid 667] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 668] <... futex resumed>) = 1 [pid 667] <... rt_sigaction resumed>NULL, 8) = 0 [pid 664] <... write resumed>) = 1045 [pid 656] <... futex resumed>) = 0 [pid 652] close(5 [ 26.273639][ T657] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.287757][ T657] EXT4-fs (loop0): get root inode failed [ 26.293467][ T657] EXT4-fs (loop0): mount failed [ 26.301332][ T662] EXT4-fs (loop1): 1 orphan inode deleted [ 26.304364][ T663] loop5: detected capacity change from 0 to 512 [ 26.306890][ T662] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 665] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 667] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 667] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 667] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 667] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[673]}, 88) = 673 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 667] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 667] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 667] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[674]}, 88) = 674 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] <... open resumed>) = 6 [pid 663] <... ioctl resumed>) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] close(3 [pid 666] <... futex resumed>) = 1 [pid 665] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 664] <... futex resumed>) = 1 [pid 661] <... futex resumed>) = 0 [pid 657] ioctl(5, LOOP_CLR_FD [pid 655] <... futex resumed>) = 0 [pid 652] <... close resumed>) = 0 [pid 664] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] <... ioctl resumed>) = 0 [pid 652] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] close(5 [pid 652] <... futex resumed>) = 0 [pid 657] <... close resumed>) = 0 [pid 652] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 673 attached ./strace-static-x86_64: Process 674 attached [pid 674] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 673] set_robust_list(0x7f0c4a20e9a0, 24 [pid 674] <... set_robust_list resumed>) = 0 [pid 673] <... set_robust_list resumed>) = 0 [pid 674] rt_sigprocmask(SIG_SETMASK, [], [pid 673] rt_sigprocmask(SIG_SETMASK, [], [pid 674] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 673] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 674] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 673] memfd_create("syzkaller", 0) = 3 [pid 668] <... write resumed>) = 8 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 663] <... close resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... futex resumed>) = 0 [pid 668] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... write resumed>) = 1045 [pid 663] mkdir("./bus", 0777 [pid 655] <... futex resumed>) = 0 [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 674] <... open resumed>) = 4 [pid 666] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 663] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 654] exit_group(0 [pid 648] exit_group(0 [pid 663] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 660] <... futex resumed>) = ? [pid 657] <... futex resumed>) = ? [pid 654] <... exit_group resumed>) = ? [pid 653] <... futex resumed>) = ? [pid 652] <... futex resumed>) = ? [pid 648] <... exit_group resumed>) = ? [pid 673] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 660] +++ exited with 0 +++ [pid 657] +++ exited with 0 +++ [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] +++ exited with 0 +++ [pid 652] +++ exited with 0 +++ [pid 673] <... mmap resumed>) = 0x7f0c41dcd000 [pid 674] <... futex resumed>) = 1 [pid 667] <... futex resumed>) = 0 [pid 648] +++ exited with 0 +++ [pid 666] <... write resumed>) = 8 [pid 674] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=648, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 674] <... futex resumed>) = 0 [pid 673] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 666] <... futex resumed>) = 1 [pid 655] <... futex resumed>) = 0 [pid 674] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 673] <... write resumed>) = 262144 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 673] munmap(0x7f0c41dcd000, 138412032 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 673] <... munmap resumed>) = 0 [pid 673] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 5 [pid 673] ioctl(5, LOOP_SET_FD, 3 [pid 666] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 662] <... mount resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 655] <... futex resumed>) = 0 [pid 298] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 662] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 662] ioctl(4, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 662] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 662] close(4 [pid 298] newfstatat(3, "", [pid 673] <... ioctl resumed>) = 0 [pid 666] <... write resumed>) = 1045 [pid 662] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 666] <... futex resumed>) = 1 [pid 662] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 662] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./11/binderfs") = 0 [pid 298] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./11/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./11") = 0 [pid 298] mkdir("./12", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 677 [pid 661] exit_group(0 [pid 664] <... futex resumed>) = ? [pid 662] <... futex resumed>) = ? [pid 661] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 677 attached [pid 673] close(3 [pid 664] +++ exited with 0 +++ [pid 662] +++ exited with 0 +++ [pid 661] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=661, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [ 26.324637][ T662] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/12/file1 supports timestamps until 2038 (0x7fffffff) [ 26.347959][ T673] loop2: detected capacity change from 0 to 512 [ 26.354951][ T665] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.368969][ T665] EXT4-fs (loop3): get root inode failed [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] set_robust_list(0x555556d8d6a0, 24 [pid 673] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 677] <... set_robust_list resumed>) = 0 [pid 677] chdir("./12") = 0 [pid 677] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 677] setpgid(0, 0) = 0 [pid 677] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 673] mkdir("./file1", 0777 [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] write(3, "1000", 4) = 4 [pid 677] close(3) = 0 [pid 677] symlink("/dev/binderfs", "./binderfs") = 0 [pid 677] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 677] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 677] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 677] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 677] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 677] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 680 attached [pid 673] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 677] <... clone3 resumed> => {parent_tid=[680]}, 88) = 680 [pid 680] set_robust_list(0x7f0c4a20e9a0, 24 [pid 673] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 654] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./12/bus", [pid 680] <... set_robust_list resumed>) = 0 [pid 677] rt_sigprocmask(SIG_SETMASK, [], [pid 665] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 680] rt_sigprocmask(SIG_SETMASK, [], [pid 677] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 665] ioctl(4, LOOP_CLR_FD [pid 295] unlink("./12/bus" [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=654, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 680] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 677] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] <... ioctl resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 294] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 680] memfd_create("syzkaller", 0 [pid 677] <... futex resumed>) = 0 [pid 665] close(4 [pid 295] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 680] <... memfd_create resumed>) = 3 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 680] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 677] <... futex resumed>) = 0 [pid 665] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] exit_group(0 [pid 295] newfstatat(AT_FDCWD, "./12/binderfs", [pid 294] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 680] <... mmap resumed>) = 0x7f0c41dee000 [pid 677] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 668] <... futex resumed>) = ? [pid 665] <... futex resumed>) = ? [pid 656] <... exit_group resumed>) = ? [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... openat resumed>) = 3 [pid 680] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 677] <... mmap resumed>) = 0x7f0c41dcd000 [pid 668] +++ exited with 0 +++ [pid 665] +++ exited with 0 +++ [pid 295] unlink("./12/binderfs" [pid 680] <... write resumed>) = 262144 [pid 677] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 295] <... unlink resumed>) = 0 [pid 294] newfstatat(3, "", [pid 680] munmap(0x7f0c41dee000, 138412032 [pid 677] <... mprotect resumed>) = 0 [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 680] <... munmap resumed>) = 0 [pid 677] rt_sigprocmask(SIG_BLOCK, ~[], [pid 663] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 294] getdents64(3, [pid 680] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 677] <... rt_sigprocmask resumed>[], 8) = 0 [pid 663] ioctl(5, LOOP_CLR_FD [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 680] <... openat resumed>) = 4 [pid 677] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 294] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 680] ioctl(4, LOOP_SET_FD, 3 [pid 677] <... clone3 resumed> => {parent_tid=[683]}, 88) = 683 [pid 294] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 677] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] newfstatat(AT_FDCWD, "./12/bus", [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 677] <... futex resumed>) = 0 [pid 294] unlink("./12/bus" [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... unlink resumed>) = 0 [pid 294] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./12/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./12") = 0 [pid 294] mkdir("./13", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 684 [pid 663] <... ioctl resumed>) = 0 [pid 663] close(5) = 0 [ 26.374530][ T663] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.374578][ T665] EXT4-fs (loop3): mount failed [ 26.392291][ T663] EXT4-fs (loop5): get root inode failed [ 26.397861][ T663] EXT4-fs (loop5): mount failed [ 26.418725][ T680] loop4: detected capacity change from 0 to 512 [pid 663] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 655] exit_group(0 [pid 666] <... futex resumed>) = ? [pid 663] <... futex resumed>) = ? [pid 655] <... exit_group resumed>) = ? [pid 666] +++ exited with 0 +++ [pid 663] +++ exited with 0 +++ ./strace-static-x86_64: Process 683 attached [pid 683] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 683] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 683] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] <... futex resumed>) = 0 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 683] <... futex resumed>) = 1 [pid 683] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] <... futex resumed>) = 0 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 683] <... futex resumed>) = 1 [pid 683] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 680] <... ioctl resumed>) = 0 [pid 680] close(3) = 0 [pid 680] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 680] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 684 attached [pid 684] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 684] chdir("./13" [pid 656] +++ exited with 0 +++ [pid 655] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=655, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=656, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 684] <... chdir resumed>) = 0 [pid 299] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] <... open resumed>) = 6 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 683] <... futex resumed>) = 1 [pid 677] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 683] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 677] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 684] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 684] <... prctl resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] setpgid(0, 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 684] <... setpgid resumed>) = 0 [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 684] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./12/bus", [pid 297] newfstatat(AT_FDCWD, "./12/bus", [pid 295] newfstatat(AT_FDCWD, "./12/file1", [pid 684] write(3, "1000", 4 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 684] <... write resumed>) = 4 [pid 683] <... write resumed>) = 8 [pid 299] unlink("./12/bus" [pid 297] unlink("./12/bus" [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] close(3 [pid 299] <... unlink resumed>) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 684] <... close resumed>) = 0 [pid 299] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./12/binderfs", [pid 297] newfstatat(AT_FDCWD, "./12/binderfs", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./12/binderfs" [pid 297] unlink("./12/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 684] symlink("/dev/binderfs", "./binderfs" [pid 683] <... futex resumed>) = 1 [pid 677] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 684] <... symlink resumed>) = 0 [pid 683] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 297] close(3 [pid 684] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 683] <... write resumed>) = 1045 [pid 677] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 4 [pid 684] <... futex resumed>) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] rmdir("./12" [pid 297] rmdir("./12" [pid 299] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 299] mkdir("./13", 0777 [pid 297] mkdir("./13", 0777 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 297] close(3 [pid 299] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [ 26.429025][ T673] EXT4-fs (loop2): 1 orphan inode deleted [ 26.434600][ T673] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.448096][ T673] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/12/file1 supports timestamps until 2038 (0x7fffffff) [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 688 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 689 ./strace-static-x86_64: Process 688 attached [pid 688] set_robust_list(0x555556d8d6a0, 24./strace-static-x86_64: Process 689 attached [pid 689] set_robust_list(0x555556d8d6a0, 24 [pid 688] <... set_robust_list resumed>) = 0 [pid 689] <... set_robust_list resumed>) = 0 [pid 689] chdir("./13" [pid 688] chdir("./13") = 0 [pid 689] <... chdir resumed>) = 0 [pid 689] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 688] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 689] <... prctl resumed>) = 0 [pid 688] <... prctl resumed>) = 0 [pid 689] setpgid(0, 0 [pid 688] setpgid(0, 0 [pid 689] <... setpgid resumed>) = 0 [pid 688] <... setpgid resumed>) = 0 [pid 689] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 688] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 684] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 677] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] newfstatat(4, "", [pid 689] <... openat resumed>) = 3 [pid 688] <... openat resumed>) = 3 [pid 684] <... rt_sigaction resumed>NULL, 8) = 0 [pid 683] <... futex resumed>) = 0 [pid 673] ioctl(5, LOOP_CLR_FD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 689] write(3, "1000", 4 [pid 688] write(3, "1000", 4 [pid 684] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 683] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] getdents64(4, [pid 689] <... write resumed>) = 4 [pid 688] <... write resumed>) = 4 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] close(3 [pid 688] close(3 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 689] <... close resumed>) = 0 [pid 688] <... close resumed>) = 0 [pid 684] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] getdents64(4, [pid 689] symlink("/dev/binderfs", "./binderfs" [pid 688] symlink("/dev/binderfs", "./binderfs" [pid 684] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 689] <... symlink resumed>) = 0 [pid 688] <... symlink resumed>) = 0 [pid 684] <... mprotect resumed>) = 0 [pid 295] close(4 [pid 689] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] <... close resumed>) = 0 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 684] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] rmdir("./12/file1" [pid 689] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 688] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 684] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 689] <... rt_sigaction resumed>NULL, 8) = 0 [pid 688] <... rt_sigaction resumed>NULL, 8) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 689] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 688] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 684] <... clone3 resumed> => {parent_tid=[690]}, 88) = 690 [pid 295] getdents64(3, [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 684] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 690 attached [pid 689] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 688] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 689] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 688] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 689] <... mprotect resumed>) = 0 [pid 688] <... mprotect resumed>) = 0 [pid 689] rt_sigprocmask(SIG_BLOCK, ~[], [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [pid 689] <... rt_sigprocmask resumed>[], 8) = 0 [pid 688] <... rt_sigprocmask resumed>[], 8) = 0 [pid 689] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 690] set_robust_list(0x7f0c4a20e9a0, 24 [pid 684] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 689] <... clone3 resumed> => {parent_tid=[691]}, 88) = 691 [pid 688] <... clone3 resumed> => {parent_tid=[692]}, 88) = 692 [pid 689] rt_sigprocmask(SIG_SETMASK, [], [pid 688] rt_sigprocmask(SIG_SETMASK, [], [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 689] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 690] <... set_robust_list resumed>) = 0 [pid 689] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 688] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 684] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 690] rt_sigprocmask(SIG_SETMASK, [], [pid 689] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 688] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] <... ioctl resumed>) = 0 [pid 689] <... mprotect resumed>) = 0 [pid 688] <... mprotect resumed>) = 0 [pid 673] close(5 [pid 690] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] rt_sigprocmask(SIG_BLOCK, ~[], [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [pid 684] <... futex resumed>) = 0 [pid 673] <... close resumed>) = 0 [pid 295] rmdir("./12"./strace-static-x86_64: Process 692 attached [pid 689] <... rt_sigprocmask resumed>[], 8) = 0 [pid 688] <... rt_sigprocmask resumed>[], 8) = 0 [pid 673] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] set_robust_list(0x7f0c4a20e9a0, 24 [pid 689] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 673] <... futex resumed>) = 0 [pid 667] exit_group(0./strace-static-x86_64: Process 691 attached [pid 692] <... set_robust_list resumed>) = 0 [pid 690] memfd_create("syzkaller", 0 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 667] <... exit_group resumed>) = ? [pid 692] rt_sigprocmask(SIG_SETMASK, [], [pid 691] set_robust_list(0x7f0c4a20e9a0, 24 [pid 690] <... memfd_create resumed>) = 3 [pid 689] <... clone3 resumed> => {parent_tid=[693]}, 88) = 693 [pid 688] <... clone3 resumed> => {parent_tid=[694]}, 88) = 694 [pid 684] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 674] <... futex resumed>) = ? [pid 673] +++ exited with 0 +++ [pid 295] <... rmdir resumed>) = 0 [pid 692] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 691] <... set_robust_list resumed>) = 0 [pid 690] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 689] rt_sigprocmask(SIG_SETMASK, [], [pid 688] rt_sigprocmask(SIG_SETMASK, [], [pid 684] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 692] memfd_create("syzkaller", 0 [pid 691] rt_sigprocmask(SIG_SETMASK, [], [pid 690] <... mmap resumed>) = 0x7f0c41dcd000 [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 684] <... mprotect resumed>) = 0 [pid 674] +++ exited with 0 +++ [pid 667] +++ exited with 0 +++ [pid 295] mkdir("./13", 0777 [pid 692] <... memfd_create resumed>) = 3 [pid 691] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=667, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 692] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 691] memfd_create("syzkaller", 0 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 690] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 692] <... mmap resumed>) = 0x7f0c41dcd000 [pid 691] <... memfd_create resumed>) = 3 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 692] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 691] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 690] <... write resumed>) = 262144 [pid 684] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 3 ./strace-static-x86_64: Process 694 attached ./strace-static-x86_64: Process 693 attached [pid 692] <... write resumed>) = 262144 [pid 691] <... mmap resumed>) = 0x7f0c41dcd000 [pid 690] munmap(0x7f0c41dcd000, 138412032 [pid 680] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] ioctl(3, LOOP_CLR_FD [pid 694] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 693] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 690] <... munmap resumed>) = 0 [pid 684] <... clone3 resumed> => {parent_tid=[695]}, 88) = 695 [pid 680] ioctl(4, LOOP_CLR_FD [pid 296] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 694] <... set_robust_list resumed>) = 0 [pid 693] <... set_robust_list resumed>) = 0 [pid 690] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 684] rt_sigprocmask(SIG_SETMASK, [], [pid 680] <... ioctl resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] close(3./strace-static-x86_64: Process 695 attached [pid 694] rt_sigprocmask(SIG_SETMASK, [], [pid 693] rt_sigprocmask(SIG_SETMASK, [], [pid 692] munmap(0x7f0c41dcd000, 138412032 [pid 691] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 690] <... openat resumed>) = 4 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 680] close(4 [pid 296] newfstatat(3, "", [pid 295] <... close resumed>) = 0 [pid 695] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 692] <... munmap resumed>) = 0 [pid 691] <... write resumed>) = 262144 [pid 690] ioctl(4, LOOP_SET_FD, 3 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 680] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 26.492377][ T680] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.518216][ T680] EXT4-fs (loop4): get root inode failed [ 26.523832][ T680] EXT4-fs (loop4): mount failed [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 695] <... set_robust_list resumed>) = 0 [pid 693] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 692] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 691] munmap(0x7f0c41dcd000, 138412032 [pid 296] getdents64(3, [pid 695] rt_sigprocmask(SIG_SETMASK, [], [pid 692] <... openat resumed>) = 4 [pid 691] <... munmap resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 695] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 692] ioctl(4, LOOP_SET_FD, 3 [pid 691] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 696 attached [pid 694] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 693] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 690] <... ioctl resumed>) = 0 [pid 684] <... futex resumed>) = 0 [pid 680] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] set_robust_list(0x555556d8d6a0, 24 [pid 695] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 694] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 693] <... open resumed>) = 4 [pid 691] <... openat resumed>) = 5 [pid 690] close(3 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 680] <... futex resumed>) = 0 [pid 692] <... ioctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 696 [pid 696] <... set_robust_list resumed>) = 0 [pid 694] <... open resumed>) = 5 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 690] <... close resumed>) = 0 [pid 680] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 696] chdir("./13" [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = 1 [pid 691] ioctl(5, LOOP_SET_FD, 3 [pid 690] mkdir("./bus", 0777 [pid 296] newfstatat(AT_FDCWD, "./12/binderfs", [pid 696] <... chdir resumed>) = 0 [pid 695] <... open resumed>) = 3 [pid 694] <... futex resumed>) = 1 [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 677] exit_group(0 [pid 696] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 683] <... futex resumed>) = ? [pid 680] <... futex resumed>) = ? [pid 677] <... exit_group resumed>) = ? [pid 696] <... prctl resumed>) = 0 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] close(3 [pid 691] <... ioctl resumed>) = 0 [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 683] +++ exited with 0 +++ [pid 680] +++ exited with 0 +++ [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 696] setpgid(0, 0 [pid 695] <... futex resumed>) = 1 [pid 694] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 0 [pid 692] <... close resumed>) = 0 [pid 691] close(3 [pid 689] <... futex resumed>) = 1 [pid 688] <... futex resumed>) = 1 [pid 684] <... futex resumed>) = 0 [pid 296] unlink("./12/binderfs" [pid 696] <... setpgid resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 693] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 694] <... mount resumed>) = 0 [pid 693] <... mount resumed>) = 0 [pid 692] mkdir("./bus", 0777 [pid 691] <... close resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 696] <... openat resumed>) = 3 [pid 695] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 696] write(3, "1000", 4 [pid 695] <... mount resumed>) = 0 [pid 694] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 1 [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 696] <... write resumed>) = 4 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./12/file1", [pid 696] close(3 [pid 695] <... futex resumed>) = 1 [pid 694] <... open resumed>) = 3 [pid 693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 696] <... close resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./12/file1" [pid 696] symlink("/dev/binderfs", "./binderfs" [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 694] <... futex resumed>) = 0 [pid 693] <... open resumed>) = 3 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] <... futex resumed>) = 0 [pid 696] <... symlink resumed>) = 0 [pid 695] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 694] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = 0 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 696] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] <... open resumed>) = 5 [pid 694] <... write resumed>) = 8 [pid 693] <... futex resumed>) = 1 [pid 692] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 691] mkdir("./bus", 0777 [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 696] <... futex resumed>) = 0 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 692] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 691] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 696] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 695] <... futex resumed>) = 1 [pid 691] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 684] <... futex resumed>) = 0 [pid 296] close(3 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./12") = 0 [pid 296] mkdir("./13", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 699 [pid 694] <... futex resumed>) = 1 [pid 688] <... futex resumed>) = 0 [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 688] <... futex resumed>) = 0 [pid 694] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] <... futex resumed>) = 0 [ 26.552013][ T690] loop0: detected capacity change from 0 to 512 [ 26.555329][ T692] loop5: detected capacity change from 0 to 512 [ 26.566637][ T691] loop3: detected capacity change from 0 to 512 [ 26.582027][ T690] EXT4-fs (loop0): 1 orphan inode deleted [ 26.587604][ T690] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 699 attached [pid 696] <... rt_sigaction resumed>NULL, 8) = 0 [pid 694] <... write resumed>) = 1045 [pid 693] <... write resumed>) = 8 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = 1 [pid 693] <... futex resumed>) = 1 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 689] <... futex resumed>) = 0 [pid 693] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] <... write resumed>) = 1045 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 689] <... futex resumed>) = 0 [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 699] chdir("./13") = 0 [pid 699] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 699] setpgid(0, 0) = 0 [pid 699] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 696] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 695] <... futex resumed>) = 0 [pid 684] <... futex resumed>) = 1 [pid 699] write(3, "1000", 4 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 695] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 692] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 695] <... write resumed>) = 8 [pid 692] ioctl(4, LOOP_CLR_FD [pid 696] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] <... ioctl resumed>) = 0 [pid 696] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 695] <... futex resumed>) = 1 [pid 692] close(4 [pid 684] <... futex resumed>) = 0 [pid 696] <... mprotect resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 692] <... close resumed>) = 0 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 699] <... write resumed>) = 4 [pid 696] rt_sigprocmask(SIG_BLOCK, ~[], [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 692] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] <... futex resumed>) = 0 [pid 677] +++ exited with 0 +++ [pid 699] close(3 [pid 696] <... rt_sigprocmask resumed>[], 8) = 0 [pid 695] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 692] <... futex resumed>) = 0 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=677, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 699] <... close resumed>) = 0 [pid 696] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 695] <... write resumed>) = 1045 [pid 692] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 688] exit_group(0 [pid 699] symlink("/dev/binderfs", "./binderfs" [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = ? [pid 692] <... futex resumed>) = ? [pid 688] <... exit_group resumed>) = ? [pid 699] <... symlink resumed>) = 0 [pid 696] <... clone3 resumed> => {parent_tid=[702]}, 88) = 702 [pid 695] <... futex resumed>) = 1 [pid 694] +++ exited with 0 +++ [pid 692] +++ exited with 0 +++ [pid 690] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 684] <... futex resumed>) = 0 [pid 298] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] rt_sigprocmask(SIG_SETMASK, [], [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 699] <... futex resumed>) = 0 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 690] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 699] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 696] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 690] close(4 [pid 298] <... openat resumed>) = 3 [pid 699] <... rt_sigaction resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 699] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 699] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 696] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 699] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 696] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 696] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 699] <... mprotect resumed>) = 0 [pid 696] <... mprotect resumed>) = 0 [pid 699] rt_sigprocmask(SIG_BLOCK, ~[], [pid 696] rt_sigprocmask(SIG_BLOCK, ~[], [pid 699] <... rt_sigprocmask resumed>[], 8) = 0 [pid 696] <... rt_sigprocmask resumed>[], 8) = 0 [pid 699] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 696] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 704 attached ./strace-static-x86_64: Process 703 attached ./strace-static-x86_64: Process 702 attached [pid 699] <... clone3 resumed> => {parent_tid=[703]}, 88) = 703 [pid 696] <... clone3 resumed> => {parent_tid=[704]}, 88) = 704 [pid 690] <... close resumed>) = 0 [ 26.597719][ T692] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 26.598667][ T690] ext4 filesystem being mounted at /root/syzkaller.iF59aB/13/bus supports timestamps until 2038 (0x7fffffff) [ 26.617486][ T691] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.646495][ T691] EXT4-fs (loop3): get root inode failed [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] rt_sigprocmask(SIG_SETMASK, [], [pid 696] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./12/bus", [pid 699] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 699] <... futex resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] unlink("./12/bus" [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 298] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 704] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 703] set_robust_list(0x7f0c4a20e9a0, 24 [pid 702] set_robust_list(0x7f0c4a20e9a0, 24 [pid 699] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 690] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] exit_group(0 [pid 298] newfstatat(AT_FDCWD, "./12/binderfs", [pid 704] <... set_robust_list resumed>) = 0 [pid 703] <... set_robust_list resumed>) = 0 [pid 702] <... set_robust_list resumed>) = 0 [pid 699] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 695] <... futex resumed>) = ? [pid 690] <... futex resumed>) = ? [pid 684] <... exit_group resumed>) = ? [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 691] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 704] rt_sigprocmask(SIG_SETMASK, [], [pid 703] rt_sigprocmask(SIG_SETMASK, [], [pid 702] rt_sigprocmask(SIG_SETMASK, [], [pid 699] <... mprotect resumed>) = 0 [pid 695] +++ exited with 0 +++ [pid 690] +++ exited with 0 +++ [pid 298] unlink("./12/binderfs" [pid 704] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 703] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 702] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 699] rt_sigprocmask(SIG_BLOCK, ~[], [pid 691] ioctl(5, LOOP_CLR_FD [pid 704] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 703] memfd_create("syzkaller", 0 [pid 702] memfd_create("syzkaller", 0 [pid 699] <... rt_sigprocmask resumed>[], 8) = 0 [pid 691] <... ioctl resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 704] <... open resumed>) = 3 [pid 703] <... memfd_create resumed>) = 3 [pid 702] <... memfd_create resumed>) = 4 [pid 699] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 691] close(5 [pid 298] getdents64(3, [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 702] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 691] <... close resumed>) = 0 [pid 704] <... futex resumed>) = 1 [pid 703] <... mmap resumed>) = 0x7f0c41dcd000 [pid 702] <... mmap resumed>) = 0x7f0c41dcd000 [pid 699] <... clone3 resumed> => {parent_tid=[705]}, 88) = 705 [pid 696] <... futex resumed>) = 0 [pid 691] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3./strace-static-x86_64: Process 705 attached [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] rt_sigprocmask(SIG_SETMASK, [], [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 705] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 691] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] rmdir("./12" [pid 705] <... set_robust_list resumed>) = 0 [pid 703] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 705] rt_sigprocmask(SIG_SETMASK, [], [pid 699] <... futex resumed>) = 0 [pid 689] exit_group(0 [pid 298] mkdir("./13", 0777 [pid 705] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 702] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 691] <... futex resumed>) = ? [pid 689] <... exit_group resumed>) = ? [pid 298] <... mkdir resumed>) = 0 [pid 705] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 704] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 693] <... futex resumed>) = ? [pid 691] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 705] <... open resumed>) = 4 [pid 298] <... openat resumed>) = 3 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 705] <... futex resumed>) = 1 [pid 699] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 705] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 704] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 705] <... mount resumed>) = 0 [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... write resumed>) = 262144 [pid 702] <... write resumed>) = 262144 [pid 704] <... futex resumed>) = 1 [pid 703] munmap(0x7f0c41dcd000, 138412032 [pid 702] munmap(0x7f0c41dcd000, 138412032./strace-static-x86_64: Process 706 attached [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] <... munmap resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 706] set_robust_list(0x555556d8d6a0, 24 [pid 705] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 703] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 702] <... munmap resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 706 [pid 706] <... set_robust_list resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 703] <... openat resumed>) = 5 [pid 702] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = 0 [pid 706] chdir("./13" [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 704] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 703] ioctl(5, LOOP_SET_FD, 3 [pid 702] <... openat resumed>) = 5 [pid 699] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 706] <... chdir resumed>) = 0 [pid 705] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 706] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... prctl resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 706] setpgid(0, 0 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 706] <... setpgid resumed>) = 0 [pid 706] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 706] write(3, "1000", 4) = 4 [pid 706] close(3) = 0 [pid 706] symlink("/dev/binderfs", "./binderfs") = 0 [pid 706] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 706] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 706] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 706] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 706] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 706] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[707]}, 88) = 707 [pid 706] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 706] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 706] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 706] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 706] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[708]}, 88) = 708 [pid 706] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 708 attached [pid 708] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 708] rt_sigprocmask(SIG_SETMASK, [], [pid 704] <... futex resumed>) = 1 [pid 702] ioctl(5, LOOP_SET_FD, 4 [pid 696] <... futex resumed>) = 0 [pid 704] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 EBADF (Bad file descriptor) [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=44000000} [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 708] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 708] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 708] <... futex resumed>) = 1 [pid 708] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 705] <... open resumed>) = 6 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 705] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 704] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... ioctl resumed>) = 0 [pid 703] close(3) = 0 [pid 696] <... futex resumed>) = 0 [pid 704] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 705] <... write resumed>) = 8 [pid 704] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 705] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 705] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] <... write resumed>) = 1045 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 703] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 707 attached [pid 702] <... ioctl resumed>) = 0 [pid 702] close(4 [pid 707] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 702] <... close resumed>) = 0 [pid 688] +++ exited with 0 +++ [pid 684] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=688, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=684, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 299] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 693] +++ exited with 0 +++ [pid 689] +++ exited with 0 +++ [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=689, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] <... restart_syscall resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... restart_syscall resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(AT_FDCWD, "./13/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] unlink("./13/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] newfstatat(3, "", [pid 299] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 294] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./13/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 294] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./13/binderfs" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 702] mkdir("./file1", 0777 [pid 299] <... unlink resumed>) = 0 [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 299] getdents64(3, [pid 294] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 702] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./13/bus", [pid 702] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] rmdir("./13" [pid 297] newfstatat(AT_FDCWD, "./13/bus", [pid 294] unlink("./13/bus" [pid 299] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] mkdir("./14", 0777 [pid 297] unlink("./13/bus" [pid 294] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./13/binderfs", [pid 299] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] newfstatat(AT_FDCWD, "./13/binderfs", [pid 294] unlink("./13/binderfs" [pid 707] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] close(3 [pid 297] unlink("./13/binderfs" [pid 294] getdents64(3, [pid 299] <... close resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 294] close(3 [pid 707] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 709 [pid 297] close(3 [pid 294] rmdir("./13"./strace-static-x86_64: Process 709 attached [pid 707] memfd_create("syzkaller", 0 [pid 297] <... close resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [ 26.652681][ T691] EXT4-fs (loop3): mount failed [ 26.672737][ T703] loop2: detected capacity change from 0 to 512 [ 26.679324][ T702] loop1: detected capacity change from 0 to 512 [ 26.690983][ T703] EXT4-fs (loop2): Invalid log block size: 2475723007 [pid 709] set_robust_list(0x555556d8d6a0, 24 [pid 707] <... memfd_create resumed>) = 5 [pid 297] rmdir("./13" [pid 294] mkdir("./14", 0777 [pid 709] <... set_robust_list resumed>) = 0 [pid 707] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] <... rmdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 297] mkdir("./14", 0777 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] <... mkdir resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 294] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 294] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... close resumed>) = 0 [pid 297] close(3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 709] chdir("./14" [pid 707] <... mmap resumed>) = 0x7f0c41dcd000 [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 712 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 713 ./strace-static-x86_64: Process 712 attached [pid 712] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 712] chdir("./14") = 0 [pid 712] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 712] setpgid(0, 0 [pid 707] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 709] <... chdir resumed>) = 0 [pid 712] <... setpgid resumed>) = 0 [pid 709] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 712] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 712] write(3, "1000", 4) = 4 [pid 712] close(3) = 0 [pid 712] symlink("/dev/binderfs", "./binderfs" [pid 709] <... prctl resumed>) = 0 [pid 709] setpgid(0, 0) = 0 [pid 709] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 712] <... symlink resumed>) = 0 [pid 709] <... openat resumed>) = 3 ./strace-static-x86_64: Process 713 attached [pid 709] write(3, "1000", 4 [pid 713] set_robust_list(0x555556d8d6a0, 24 [pid 709] <... write resumed>) = 4 [pid 713] <... set_robust_list resumed>) = 0 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... write resumed>) = 262144 [pid 713] chdir("./14" [pid 712] <... futex resumed>) = 0 [pid 713] <... chdir resumed>) = 0 [pid 712] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 709] close(3 [pid 713] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 712] <... rt_sigaction resumed>NULL, 8) = 0 [pid 713] <... prctl resumed>) = 0 [pid 712] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 709] <... close resumed>) = 0 [pid 707] munmap(0x7f0c41dcd000, 138412032 [pid 713] setpgid(0, 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 709] symlink("/dev/binderfs", "./binderfs" [pid 713] <... setpgid resumed>) = 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 713] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 712] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 713] <... openat resumed>) = 3 [pid 712] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 709] <... symlink resumed>) = 0 [pid 713] write(3, "1000", 4 [pid 712] <... mprotect resumed>) = 0 [pid 707] <... munmap resumed>) = 0 [pid 713] <... write resumed>) = 4 [pid 712] rt_sigprocmask(SIG_BLOCK, ~[], [pid 713] close(3 [pid 712] <... rt_sigprocmask resumed>[], 8) = 0 [pid 713] <... close resumed>) = 0 [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 713] symlink("/dev/binderfs", "./binderfs") = 0 [pid 712] <... clone3 resumed> => {parent_tid=[714]}, 88) = 714 [pid 713] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] rt_sigprocmask(SIG_SETMASK, [], [pid 713] <... futex resumed>) = 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 713] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] <... rt_sigaction resumed>NULL, 8) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 703] <... mount resumed>) = -1 EINVAL (Invalid argument) [ 26.711142][ T702] EXT4-fs (loop1): 1 orphan inode deleted [ 26.716700][ T702] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.739011][ T702] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/13/file1 supports timestamps until 2038 (0x7fffffff) [pid 713] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 707] <... openat resumed>) = 6 [pid 703] ioctl(5, LOOP_CLR_FD./strace-static-x86_64: Process 714 attached [pid 709] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 707] ioctl(6, LOOP_SET_FD, 5 [pid 714] set_robust_list(0x7f0c4a20e9a0, 24 [pid 709] <... rt_sigaction resumed>NULL, 8) = 0 [pid 707] <... ioctl resumed>) = 0 [pid 714] <... set_robust_list resumed>) = 0 [pid 709] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 714] rt_sigprocmask(SIG_SETMASK, [], [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 714] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 714] memfd_create("syzkaller", 0 [pid 709] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 707] close(5 [pid 714] <... memfd_create resumed>) = 3 [pid 709] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 714] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 709] <... mprotect resumed>) = 0 [pid 707] <... close resumed>) = 0 [pid 714] <... mmap resumed>) = 0x7f0c41dee000 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [pid 714] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 713] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] <... rt_sigprocmask resumed>[], 8) = 0 [pid 707] mkdir("./file1", 0777 [pid 703] <... ioctl resumed>) = 0 [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 707] <... mkdir resumed>) = 0 [pid 703] close(5./strace-static-x86_64: Process 715 attached [pid 713] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 712] <... mmap resumed>) = 0x7f0c41dcd000 [pid 707] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 714] <... write resumed>) = 262144 [pid 713] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 712] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 709] <... clone3 resumed> => {parent_tid=[715]}, 88) = 715 [pid 715] set_robust_list(0x7f0c4a20e9a0, 24 [pid 703] <... close resumed>) = 0 [pid 702] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 715] <... set_robust_list resumed>) = 0 [pid 714] munmap(0x7f0c41dee000, 138412032 [pid 709] rt_sigprocmask(SIG_SETMASK, [], [pid 713] <... mprotect resumed>) = 0 [pid 712] <... mprotect resumed>) = 0 [pid 703] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] ioctl(5, LOOP_CLR_FD [pid 715] rt_sigprocmask(SIG_SETMASK, [], [pid 714] <... munmap resumed>) = 0 [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 714] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 709] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] memfd_create("syzkaller", 0 [pid 714] <... openat resumed>) = 4 [pid 709] <... futex resumed>) = 0 [pid 715] <... memfd_create resumed>) = 3 [pid 714] ioctl(4, LOOP_SET_FD, 3 [ 26.760282][ T707] loop4: detected capacity change from 0 to 512 [ 26.780281][ T707] EXT4-fs (loop4): 1 orphan inode deleted [ 26.786528][ T707] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.788327][ T714] loop0: detected capacity change from 0 to 512 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 713] rt_sigprocmask(SIG_BLOCK, ~[], [pid 712] rt_sigprocmask(SIG_BLOCK, ~[], [pid 709] <... futex resumed>) = 0 [pid 703] <... futex resumed>) = 0 [pid 699] exit_group(0 [pid 715] <... mmap resumed>) = 0x7f0c41dee000 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 705] <... futex resumed>) = ? [pid 699] <... exit_group resumed>) = ? [pid 715] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 709] <... mmap resumed>) = 0x7f0c41dcd000 [pid 705] +++ exited with 0 +++ [pid 715] <... write resumed>) = 262144 [pid 709] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} => {parent_tid=[718]}, 88) = 718 [pid 709] rt_sigprocmask(SIG_SETMASK, [], [pid 715] munmap(0x7f0c41dee000, 138412032 [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] <... munmap resumed>) = 0 [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 715] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 718 attached [pid 714] <... ioctl resumed>) = 0 [pid 713] <... rt_sigprocmask resumed>[], 8) = 0 [pid 712] <... rt_sigprocmask resumed>[], 8) = 0 [pid 707] <... mount resumed>) = 0 [pid 718] set_robust_list(0x7f0c41ded9a0, 24 [pid 715] <... ioctl resumed>) = 0 [pid 714] close(3 [pid 713] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 707] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 714] <... close resumed>) = 0 [pid 714] mkdir("./file1", 0777 [pid 718] <... set_robust_list resumed>) = 0 [pid 715] close(3 [pid 707] <... openat resumed>) = 5 ./strace-static-x86_64: Process 719 attached ./strace-static-x86_64: Process 720 attached [pid 713] <... clone3 resumed> => {parent_tid=[719]}, 88) = 719 [pid 714] <... mkdir resumed>) = 0 [pid 712] <... clone3 resumed> => {parent_tid=[720]}, 88) = 720 [pid 707] chdir("./file1" [pid 718] rt_sigprocmask(SIG_SETMASK, [], [pid 715] <... close resumed>) = 0 [pid 714] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 720] set_robust_list(0x7f0c41ded9a0, 24 [pid 719] set_robust_list(0x7f0c4a20e9a0, 24 [pid 718] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] mkdir("./file1", 0777 [pid 713] rt_sigprocmask(SIG_SETMASK, [], [pid 712] rt_sigprocmask(SIG_SETMASK, [], [pid 707] <... chdir resumed>) = 0 [pid 720] <... set_robust_list resumed>) = 0 [pid 719] <... set_robust_list resumed>) = 0 [pid 718] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 713] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 707] ioctl(6, LOOP_CLR_FD [pid 720] rt_sigprocmask(SIG_SETMASK, [], [pid 719] rt_sigprocmask(SIG_SETMASK, [], [pid 715] <... mkdir resumed>) = 0 [pid 713] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... ioctl resumed>) = 0 [pid 720] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 719] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 718] <... open resumed>) = -1 EISDIR (Is a directory) [pid 715] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 713] <... futex resumed>) = 0 [pid 712] <... futex resumed>) = 0 [pid 707] close(6 [pid 720] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 719] memfd_create("syzkaller", 0 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 707] <... close resumed>) = 0 [pid 719] <... memfd_create resumed>) = 3 [pid 713] <... futex resumed>) = 0 [pid 709] <... futex resumed>) = 0 [pid 718] <... futex resumed>) = 1 [pid 707] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] <... open resumed>) = 3 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 719] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 718] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... futex resumed>) = 0 [pid 706] exit_group(0 [pid 720] <... futex resumed>) = 1 [pid 719] <... mmap resumed>) = 0x7f0c41dee000 [pid 718] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 713] <... mmap resumed>) = 0x7f0c41dcd000 [pid 712] <... futex resumed>) = 0 [pid 709] <... futex resumed>) = 0 [pid 707] ????( [pid 713] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... exit_group resumed>) = ? [pid 708] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 707] <... ???? resumed>) = ? [pid 713] <... mprotect resumed>) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] +++ exited with 0 +++ [pid 713] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 707] +++ exited with 0 +++ [pid 706] +++ exited with 0 +++ [pid 713] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} => {parent_tid=[723]}, 88) = 723 [pid 713] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 720] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 719] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 712] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 719] munmap(0x7f0c41dee000, 138412032 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] <... ioctl resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=706, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 719] <... munmap resumed>) = 0 [pid 719] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 26.798804][ T707] ext4 filesystem being mounted at /root/syzkaller.qPQybd/13/file1 supports timestamps until 2038 (0x7fffffff) [ 26.809580][ T715] loop5: detected capacity change from 0 to 512 [ 26.833869][ T714] EXT4-fs (loop0): 1 orphan inode deleted [ 26.841116][ T714] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.842958][ T719] loop3: detected capacity change from 0 to 512 [pid 719] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 723 attached [pid 720] <... futex resumed>) = 0 [pid 718] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 1 [pid 709] <... futex resumed>) = 0 [pid 703] +++ exited with 0 +++ [pid 702] close(5 [pid 699] +++ exited with 0 +++ [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 719] <... ioctl resumed>) = 0 [pid 719] close(3) = 0 [pid 719] mkdir("./file1", 0777) = 0 [pid 719] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 723] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 723] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 723] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] <... close resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 723] <... futex resumed>) = 1 [pid 713] <... futex resumed>) = 0 [pid 723] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] <... mount resumed>) = 0 [pid 713] <... futex resumed>) = 0 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 723] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] <... open resumed>) = 5 [pid 713] <... futex resumed>) = 0 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 723] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... mount resumed>) = 0 [pid 714] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 714] ioctl(4, LOOP_CLR_FD) = 0 [pid 714] close(4) = 0 [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 720] <... open resumed>) = 4 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 720] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 718] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 718] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = -1 EISDIR (Is a directory) [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... futex resumed>) = 0 [pid 714] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 709] <... futex resumed>) = 1 [pid 702] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 702] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] exit_group(0 [pid 709] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] <... futex resumed>) = ? [pid 696] <... exit_group resumed>) = ? [pid 709] <... futex resumed>) = 0 [pid 704] +++ exited with 0 +++ [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 723] <... write resumed>) = 8 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=699, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 702] +++ exited with 0 +++ [pid 296] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 696] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=696, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 718] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 718] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 723] <... futex resumed>) = 1 [pid 718] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 713] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 713] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 718] <... futex resumed>) = 1 [pid 709] <... futex resumed>) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 718] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 709] <... futex resumed>) = 0 [pid 718] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 296] getdents64(3, [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 709] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 718] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 723] <... write resumed>) = 1045 [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 723] <... futex resumed>) = 1 [pid 713] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 723] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 295] newfstatat(3, "", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] newfstatat(AT_FDCWD, "./13/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./13/bus" [pid 296] newfstatat(AT_FDCWD, "./13/bus", [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 298] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./13/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./13/binderfs", [pid 296] <... unlink resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./13/binderfs", [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./13/binderfs" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] unlink("./13/binderfs" [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./13/binderfs", [pid 295] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./13/binderfs" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./13/file1", [pid 296] <... unlink resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 295] unlink("./13/file1") = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 296] close(3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 296] rmdir("./13" [pid 295] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./14", 0777 [pid 295] rmdir("./13" [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] mkdir("./14", 0777 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... mkdir resumed>) = 0 [pid 714] <... write resumed>) = 8 [pid 296] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 714] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... openat resumed>) = 3 [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [ 26.852895][ T714] ext4 filesystem being mounted at /root/syzkaller.iF59aB/14/file1 supports timestamps until 2038 (0x7fffffff) [ 26.886906][ T719] EXT4-fs (loop3): can't read group descriptor 0 [ 26.887259][ T715] EXT4-fs (loop5): 1 orphan inode deleted [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 726 attached [pid 719] <... mount resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 714] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 712] <... futex resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 714] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 726 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 714] <... write resumed>) = 1045 [pid 295] close(3 [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 714] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] exit_group(0 [pid 714] <... futex resumed>) = ? [pid 712] <... exit_group resumed>) = ? [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 727 [pid 714] +++ exited with 0 +++ [pid 719] ioctl(4, LOOP_CLR_FD) = 0 [pid 719] close(4) = 0 [pid 719] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] exit_group(0 [pid 723] <... futex resumed>) = ? [pid 713] <... exit_group resumed>) = ? [pid 723] +++ exited with 0 +++ [pid 719] <... futex resumed>) = ? [pid 726] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 726] chdir("./14") = 0 [pid 726] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 726] setpgid(0, 0) = 0 [pid 726] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 726] write(3, "1000", 4) = 4 [pid 726] close(3) = 0 [pid 726] symlink("/dev/binderfs", "./binderfs") = 0 [pid 726] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 726] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 726] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[728]}, 88) = 728 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 726] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[729]}, 88) = 729 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 727 attached [pid 727] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 727] chdir("./14") = 0 [pid 727] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 727] setpgid(0, 0) = 0 [pid 727] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 727] write(3, "1000", 4) = 4 [pid 727] close(3) = 0 [pid 727] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 729 attached ./strace-static-x86_64: Process 728 attached [pid 720] <... futex resumed>) = ? [pid 727] <... symlink resumed>) = 0 [pid 728] set_robust_list(0x7f0c4a20e9a0, 24 [pid 720] +++ exited with 0 +++ [pid 712] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 729] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 728] <... set_robust_list resumed>) = 0 [pid 729] <... set_robust_list resumed>) = 0 [pid 728] rt_sigprocmask(SIG_SETMASK, [], [pid 729] rt_sigprocmask(SIG_SETMASK, [], [pid 728] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 727] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 729] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 728] memfd_create("syzkaller", 0 [pid 729] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 728] <... memfd_create resumed>) = 3 [pid 727] <... futex resumed>) = 0 [pid 729] <... open resumed>) = 4 [pid 728] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 728] <... mmap resumed>) = 0x7f0c41dcd000 [pid 727] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 729] <... futex resumed>) = 1 [pid 728] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] <... rt_sigaction resumed>NULL, 8) = 0 [pid 728] <... write resumed>) = 262144 [pid 727] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 728] munmap(0x7f0c41dcd000, 138412032 [pid 727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 728] <... munmap resumed>) = 0 [pid 727] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 728] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 727] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 728] <... openat resumed>) = 5 [pid 727] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 728] ioctl(5, LOOP_SET_FD, 3 [pid 727] <... mprotect resumed>) = 0 [pid 726] <... futex resumed>) = 0 [pid 719] +++ exited with 0 +++ [pid 715] <... mount resumed>) = 0 [pid 713] +++ exited with 0 +++ [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=712, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=713, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 729] <... futex resumed>) = 0 [pid 726] <... futex resumed>) = 1 [pid 715] <... openat resumed>) = 3 [pid 298] newfstatat(AT_FDCWD, "./13/file1", [pid 294] <... restart_syscall resumed>) = 0 [pid 729] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] chdir("./bus" [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 729] <... mount resumed>) = 0 [pid 715] <... chdir resumed>) = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] <... futex resumed>) = 1 [pid 726] <... futex resumed>) = 0 [pid 715] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] close(4 [pid 298] <... openat resumed>) = 4 [pid 297] <... openat resumed>) = 3 [pid 294] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 729] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 726] <... futex resumed>) = 0 [pid 715] <... close resumed>) = 0 [pid 298] newfstatat(4, "", [pid 297] newfstatat(3, "", [pid 294] <... openat resumed>) = 3 [pid 729] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(3, "", [pid 715] <... futex resumed>) = 0 [pid 709] exit_group(0 [pid 298] getdents64(4, [pid 297] getdents64(3, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 718] <... futex resumed>) = ? [pid 709] <... exit_group resumed>) = ? [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] getdents64(3, [pid 718] +++ exited with 0 +++ [pid 715] +++ exited with 0 +++ [pid 709] +++ exited with 0 +++ [pid 298] getdents64(4, [pid 297] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=709, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 294] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] close(4 [pid 297] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./13/file1" [pid 297] newfstatat(AT_FDCWD, "./14/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./14/bus", [pid 299] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] getdents64(3, [pid 297] unlink("./14/bus" [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./14/bus" [pid 299] newfstatat(3, "", [pid 298] close(3 [pid 297] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(3, [pid 298] rmdir("./13" [pid 297] newfstatat(AT_FDCWD, "./14/binderfs", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./14/binderfs", [pid 299] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] mkdir("./14", 0777 [pid 297] unlink("./14/binderfs" [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 729] <... open resumed>) = 6 [pid 728] <... ioctl resumed>) = 0 [pid 727] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./14/binderfs" [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 728] close(3 [pid 727] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 729] <... futex resumed>) = 1 [pid 726] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 728] <... close resumed>) = 0 [pid 727] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] newfstatat(AT_FDCWD, "./14/file1", [pid 729] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 726] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 729] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 727] <... clone3 resumed> => {parent_tid=[730]}, 88) = 730 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] close(3 [pid 297] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] <... write resumed>) = 8 [pid 727] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 729] <... futex resumed>) = 1 [pid 727] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 726] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 731 [pid 297] newfstatat(4, "", [pid 729] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 726] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 729] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] getdents64(4, [pid 729] <... write resumed>) = 1045 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(4, [pid 729] <... futex resumed>) = 1 [pid 726] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] close(4) = 0 [pid 297] rmdir("./14/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./14" [pid 727] <... futex resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] mkdir("./15", 0777./strace-static-x86_64: Process 730 attached [pid 727] <... futex resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 730] set_robust_list(0x7f0c4a20e9a0, 24 [pid 727] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 730] <... set_robust_list resumed>) = 0 [pid 727] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] <... openat resumed>) = 3 [pid 730] rt_sigprocmask(SIG_SETMASK, [], [pid 727] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] ioctl(3, LOOP_CLR_FD [pid 730] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 727] <... mprotect resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 730] memfd_create("syzkaller", 0 [pid 727] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] close(3 [pid 730] <... memfd_create resumed>) = 3 [pid 727] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... close resumed>) = 0 [pid 730] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 727] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 730] <... mmap resumed>) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 731 attached [pid 730] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 728] mkdir("./bus", 0777 [pid 727] <... clone3 resumed> => {parent_tid=[732]}, 88) = 732 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 733 [pid 731] set_robust_list(0x555556d8d6a0, 24 [pid 730] <... write resumed>) = 262144 [pid 728] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 727] rt_sigprocmask(SIG_SETMASK, [], [pid 731] <... set_robust_list resumed>) = 0 [pid 727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 731] chdir("./14" [pid 728] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 727] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... chdir resumed>) = 0 [pid 727] <... futex resumed>) = 0 [pid 731] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] <... prctl resumed>) = 0 [ 26.911720][ T715] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.930650][ T715] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/14/bus supports timestamps until 2038 (0x7fffffff) [ 26.940061][ T728] loop2: detected capacity change from 0 to 512 [pid 731] setpgid(0, 0 [pid 730] munmap(0x7f0c41dcd000, 138412032 [pid 731] <... setpgid resumed>) = 0 [pid 730] <... munmap resumed>) = 0 [pid 731] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 730] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 731] <... openat resumed>) = 3 [pid 730] <... openat resumed>) = 4 [pid 731] write(3, "1000", 4 [pid 730] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 733 attached ./strace-static-x86_64: Process 732 attached [pid 731] <... write resumed>) = 4 [pid 728] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 733] set_robust_list(0x555556d8d6a0, 24 [pid 732] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 733] <... set_robust_list resumed>) = 0 [pid 732] <... set_robust_list resumed>) = 0 [pid 728] ioctl(5, LOOP_CLR_FD [pid 733] chdir("./15" [pid 732] rt_sigprocmask(SIG_SETMASK, [], [pid 733] <... chdir resumed>) = 0 [pid 732] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 728] <... ioctl resumed>) = 0 [pid 733] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 732] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 733] <... prctl resumed>) = 0 [pid 732] <... open resumed>) = 5 [pid 728] close(5 [pid 733] setpgid(0, 0 [pid 732] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... setpgid resumed>) = 0 [pid 732] <... futex resumed>) = 1 [pid 731] close(3 [pid 730] <... ioctl resumed>) = 0 [pid 728] <... close resumed>) = 0 [pid 727] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 733] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 732] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] <... close resumed>) = 0 [pid 730] close(3 [pid 728] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 727] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... openat resumed>) = 3 [pid 732] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 731] symlink("/dev/binderfs", "./binderfs" [pid 730] <... close resumed>) = 0 [pid 728] <... futex resumed>) = 0 [pid 727] <... futex resumed>) = 0 [pid 733] write(3, "1000", 4 [pid 732] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 731] <... symlink resumed>) = 0 [pid 730] mkdir("./bus", 0777 [pid 728] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 726] exit_group(0 [pid 299] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 733] <... write resumed>) = 4 [pid 732] <... mount resumed>) = 0 [pid 731] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 730] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 733] close(3 [pid 732] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... futex resumed>) = 0 [pid 733] <... close resumed>) = 0 [pid 732] <... futex resumed>) = 1 [pid 731] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 730] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 729] <... futex resumed>) = ? [pid 728] <... futex resumed>) = ? [pid 727] <... futex resumed>) = 0 [pid 726] <... exit_group resumed>) = ? [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 733] symlink("/dev/binderfs", "./binderfs" [pid 732] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] <... rt_sigaction resumed>NULL, 8) = 0 [pid 729] +++ exited with 0 +++ [pid 728] +++ exited with 0 +++ [pid 727] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... symlink resumed>) = 0 [pid 732] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 731] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 727] <... futex resumed>) = 0 [pid 733] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 732] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 731] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] newfstatat(AT_FDCWD, "./14/bus", [pid 294] newfstatat(AT_FDCWD, "./14/file1", [pid 733] <... futex resumed>) = 0 [pid 732] <... open resumed>) = 3 [pid 731] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 733] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 732] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 733] <... rt_sigaction resumed>NULL, 8) = 0 [pid 732] <... futex resumed>) = 1 [pid 731] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 727] <... futex resumed>) = 0 [pid 733] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 732] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] <... mprotect resumed>) = 0 [pid 727] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 733] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 732] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 731] rt_sigprocmask(SIG_BLOCK, ~[], [pid 727] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 733] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 732] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 731] <... rt_sigprocmask resumed>[], 8) = 0 [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./14/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 733] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 732] <... write resumed>) = 8 [pid 731] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... openat resumed>) = 4 [ 26.977193][ T728] EXT4-fs (loop2): Invalid log block size: 2475723007 [ 26.978691][ T730] loop1: detected capacity change from 0 to 512 [pid 294] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 733] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 732] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(4, "", [pid 294] <... openat resumed>) = 4 [pid 733] <... mprotect resumed>) = 0 [pid 732] <... futex resumed>) = 1 [pid 731] <... clone3 resumed> => {parent_tid=[736]}, 88) = 736 [pid 727] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(4, "", [pid 733] rt_sigprocmask(SIG_BLOCK, ~[], [pid 732] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 731] rt_sigprocmask(SIG_SETMASK, [], [pid 727] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, [pid 299] getdents64(4, [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 731] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 727] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] getdents64(4, [pid 731] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 727] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] close(4 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 733] <... rt_sigprocmask resumed>[], 8) = 0 [pid 732] <... write resumed>) = 1045 [pid 731] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 294] close(4 [pid 299] rmdir("./14/bus" [pid 294] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 294] rmdir("./14/file1" [pid 299] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./14/binderfs", [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] close(3 [pid 299] unlink("./14/binderfs" [pid 294] <... close resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 294] rmdir("./14" [pid 299] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] mkdir("./15", 0777 [pid 299] close(3 [pid 294] <... mkdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] rmdir("./14" [pid 294] <... openat resumed>) = 3 [pid 299] <... rmdir resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] mkdir("./15", 0777 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... mkdir resumed>) = 0 [pid 294] close(3 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 294] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 736 attached [pid 299] ioctl(3, LOOP_CLR_FD [pid 736] set_robust_list(0x7f0c4a20e9a0, 24 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 737 [pid 736] <... set_robust_list resumed>) = 0 [pid 299] close(3 [pid 736] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... close resumed>) = 0 [pid 736] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 736] memfd_create("syzkaller", 0) = 3 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 738 [pid 736] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 736] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 736] munmap(0x7f0c41dee000, 138412032) = 0 [pid 736] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 736] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 737 attached [pid 733] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 732] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 738 attached [pid 738] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 738] chdir("./15") = 0 [pid 738] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 738] setpgid(0, 0) = 0 [pid 738] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 738] write(3, "1000", 4) = 4 [pid 738] close(3) = 0 [pid 738] symlink("/dev/binderfs", "./binderfs") = 0 [pid 738] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 738] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 738] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 738] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 738] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 738] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[739]}, 88) = 739 [pid 738] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 738] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 738] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 738] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 738] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[740]}, 88) = 740 [pid 738] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 738] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 736] <... ioctl resumed>) = 0 [pid 738] <... futex resumed>) = 0 [pid 736] close(3 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 736] <... close resumed>) = 0 [pid 736] mkdir("./file1", 0777) = 0 [pid 736] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 740 attached [pid 740] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 740] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 740] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 740] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 738] <... futex resumed>) = 0 [pid 738] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] <... futex resumed>) = 1 [pid 740] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 739 attached [pid 739] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 739] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 740] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 738] <... futex resumed>) = 0 [pid 738] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] <... futex resumed>) = 1 [pid 740] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 739] memfd_create("syzkaller", 0) = 5 [pid 740] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 738] <... futex resumed>) = 0 [pid 738] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] <... futex resumed>) = 1 [pid 739] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 738] <... futex resumed>) = 0 [pid 740] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 739] <... mmap resumed>) = 0x7f0c41dcd000 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 740] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 738] <... futex resumed>) = 0 [pid 740] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 738] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 738] <... futex resumed>) = 0 [pid 737] set_robust_list(0x555556d8d6a0, 24 [pid 732] <... futex resumed>) = 1 [pid 731] <... futex resumed>) = 0 [pid 727] <... futex resumed>) = 0 [pid 740] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 738] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] <... futex resumed>) = 0 [pid 738] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 740] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 739] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 739] munmap(0x7f0c41dcd000, 138412032) = 0 ./strace-static-x86_64: Process 741 attached [pid 741] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 741] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 741] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 739] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 6 [pid 739] ioctl(6, LOOP_SET_FD, 5 [pid 737] <... set_robust_list resumed>) = 0 [pid 733] <... clone3 resumed> => {parent_tid=[741]}, 88) = 741 [pid 732] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 737] chdir("./15" [pid 733] rt_sigprocmask(SIG_SETMASK, [], [pid 731] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 737] <... chdir resumed>) = 0 [pid 733] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 731] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 737] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 733] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... mprotect resumed>) = 0 [pid 737] <... prctl resumed>) = 0 [pid 733] <... futex resumed>) = 1 [pid 731] rt_sigprocmask(SIG_BLOCK, ~[], [pid 730] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 741] <... futex resumed>) = 0 [pid 737] setpgid(0, 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... rt_sigprocmask resumed>[], 8) = 0 [pid 726] +++ exited with 0 +++ [pid 737] <... setpgid resumed>) = 0 [pid 733] <... futex resumed>) = 0 [pid 731] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 730] ioctl(4, LOOP_CLR_FD [pid 737] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 733] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 730] <... ioctl resumed>) = 0 [pid 737] <... openat resumed>) = 3 [pid 733] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 731] <... clone3 resumed> => {parent_tid=[743]}, 88) = 743 [pid 730] close(4 [pid 741] memfd_create("syzkaller", 0 [pid 737] write(3, "1000", 4 [pid 733] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 731] rt_sigprocmask(SIG_SETMASK, [], [pid 741] <... memfd_create resumed>) = 3 [pid 737] <... write resumed>) = 4 [pid 733] <... mprotect resumed>) = 0 [pid 731] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 730] <... close resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=726, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 741] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 737] close(3 [pid 733] rt_sigprocmask(SIG_BLOCK, ~[], [pid 731] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 730] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... close resumed>) = 0 [pid 733] <... rt_sigprocmask resumed>[], 8) = 0 [pid 731] <... futex resumed>) = 0 [pid 730] <... futex resumed>) = 0 [pid 737] symlink("/dev/binderfs", "./binderfs" [pid 733] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 737] <... symlink resumed>) = 0 [pid 730] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 737] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... clone3 resumed> => {parent_tid=[744]}, 88) = 744 [pid 727] exit_group(0 [pid 737] <... futex resumed>) = 0 [pid 733] rt_sigprocmask(SIG_SETMASK, [], [pid 732] <... futex resumed>) = ? [pid 730] <... futex resumed>) = ? [pid 727] <... exit_group resumed>) = ? [pid 741] <... mmap resumed>) = 0x7f0c41dcd000 [pid 737] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 733] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 732] +++ exited with 0 +++ [pid 730] +++ exited with 0 +++ [pid 296] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 737] <... rt_sigaction resumed>NULL, 8) = 0 [pid 733] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 743 attached [pid 737] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 733] <... futex resumed>) = 0 [pid 743] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 737] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 743] <... set_robust_list resumed>) = 0 [pid 737] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 743] rt_sigprocmask(SIG_SETMASK, [], [pid 737] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 743] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 737] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 743] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 737] <... mprotect resumed>) = 0 [pid 743] <... open resumed>) = 3 [pid 737] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 743] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... rt_sigprocmask resumed>[], 8) = 0 [pid 743] <... futex resumed>) = 1 [pid 737] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 731] <... futex resumed>) = 0 [pid 743] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 743] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 737] <... clone3 resumed> => {parent_tid=[746]}, 88) = 746 [pid 731] <... futex resumed>) = 0 [pid 743] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 741] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 737] rt_sigprocmask(SIG_SETMASK, [], [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 743] <... mount resumed>) = 0 [pid 737] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 743] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 743] <... futex resumed>) = 1 [pid 737] <... futex resumed>) = 0 [pid 731] <... futex resumed>) = 0 [pid 743] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 743] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 737] <... futex resumed>) = 0 [pid 731] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 743] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 741] <... write resumed>) = 262144 [pid 737] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(3, "", [pid 743] <... open resumed>) = 5 [pid 741] munmap(0x7f0c41dcd000, 138412032 [pid 737] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 743] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 743] <... futex resumed>) = 1 [pid 741] <... munmap resumed>) = 0 [pid 737] <... mprotect resumed>) = 0 [pid 731] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 743] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 741] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 737] rt_sigprocmask(SIG_BLOCK, ~[], [pid 731] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 746 attached [pid 743] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 737] <... rt_sigprocmask resumed>[], 8) = 0 [pid 731] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 746] set_robust_list(0x7f0c4a20e9a0, 24 [pid 743] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 737] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 746] <... set_robust_list resumed>) = 0 [pid 296] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 746] rt_sigprocmask(SIG_SETMASK, [], [pid 737] <... clone3 resumed> => {parent_tid=[747]}, 88) = 747 [pid 746] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 737] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = 0 [pid 746] memfd_create("syzkaller", 0 [pid 737] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 746] <... memfd_create resumed>) = 3 [pid 737] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 746] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 737] <... futex resumed>) = 0 [ 27.015617][ T730] EXT4-fs error (device loop1): ext4_map_blocks:602: inode #3: block 9: comm syz-executor170: lblock 0 mapped to illegal pblock 9 (length 1) [ 27.027133][ T736] loop4: detected capacity change from 0 to 512 [ 27.030755][ T730] EXT4-fs warning (device loop1): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 27.052411][ T730] EXT4-fs (loop1): mount failed [ 27.057148][ T739] loop5: detected capacity change from 0 to 512 [pid 746] <... mmap resumed>) = 0x7f0c41dcd000 [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 746] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 746] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 746] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 746] ioctl(4, LOOP_SET_FD, 3 [pid 743] <... write resumed>) = 8 [pid 741] <... openat resumed>) = 4 [pid 739] <... ioctl resumed>) = 0 [pid 296] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 746] <... ioctl resumed>) = 0 [pid 746] close(3) = 0 [pid 746] mkdir("./file1", 0777) = 0 [pid 746] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 744 attached [pid 744] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 744] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 744] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 744] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... futex resumed>) = 0 [pid 733] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 1 [pid 744] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 744] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... futex resumed>) = 0 [pid 733] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 1 [pid 744] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 6 [pid 744] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... futex resumed>) = 0 [pid 733] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 1 [pid 744] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 744] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... futex resumed>) = 0 [pid 733] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 733] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 1 [pid 744] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 744] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] <... futex resumed>) = 0 [pid 744] <... futex resumed>) = 1 [pid 744] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 747 attached [pid 747] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 747] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 747] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 747] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] <... futex resumed>) = 1 [pid 747] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 747] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] <... futex resumed>) = 1 [pid 747] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 747] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... futex resumed>) = 0 [pid 743] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 743] <... futex resumed>) = 1 [pid 741] ioctl(4, LOOP_SET_FD, 3 [pid 739] close(5 [pid 731] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./14/bus", [pid 747] <... futex resumed>) = 1 [pid 747] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 747] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] <... futex resumed>) = 1 [pid 747] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = 1045 [pid 747] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 737] <... futex resumed>) = 0 [pid 747] <... futex resumed>) = 1 [pid 747] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 743] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 739] <... close resumed>) = 0 [pid 736] <... mount resumed>) = 0 [pid 731] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 743] <... futex resumed>) = 0 [pid 739] mkdir("./file1", 0777 [pid 731] <... futex resumed>) = 1 [pid 296] unlink("./14/bus" [pid 743] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 739] <... mkdir resumed>) = 0 [pid 731] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 743] <... write resumed>) = 1045 [pid 739] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 743] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 741] <... ioctl resumed>) = 0 [pid 736] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 743] <... futex resumed>) = 1 [pid 731] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./14/binderfs", [pid 743] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 741] close(3 [pid 736] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 27.084441][ T736] EXT4-fs (loop4): 1 orphan inode deleted [ 27.089315][ T746] loop0: detected capacity change from 0 to 512 [ 27.093278][ T736] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.107763][ T736] ext4 filesystem being mounted at /root/syzkaller.qPQybd/14/file1 supports timestamps until 2038 (0x7fffffff) [ 27.111000][ T741] loop3: detected capacity change from 0 to 512 [pid 296] unlink("./14/binderfs" [pid 741] <... close resumed>) = 0 [pid 736] ioctl(4, LOOP_CLR_FD [pid 296] <... unlink resumed>) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./14") = 0 [pid 296] mkdir("./15", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 750 ./strace-static-x86_64: Process 750 attached [pid 750] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 750] chdir("./15") = 0 [pid 750] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 750] setpgid(0, 0) = 0 [pid 750] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 750] write(3, "1000", 4) = 4 [pid 750] close(3) = 0 [pid 750] symlink("/dev/binderfs", "./binderfs") = 0 [pid 750] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 750] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 750] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 750] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 750] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 750] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 750] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[751]}, 88) = 751 [pid 750] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 750] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 750] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 750] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 750] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 750] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[752]}, 88) = 752 [pid 750] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 752 attached ./strace-static-x86_64: Process 751 attached NULL, 8) = 0 [pid 741] mkdir("./bus", 0777 [pid 736] <... ioctl resumed>) = 0 [pid 727] +++ exited with 0 +++ [pid 752] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 751] set_robust_list(0x7f0c4a20e9a0, 24 [pid 741] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 736] close(4 [pid 752] <... set_robust_list resumed>) = 0 [pid 751] <... set_robust_list resumed>) = 0 [pid 741] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 736] <... close resumed>) = 0 [pid 752] rt_sigprocmask(SIG_SETMASK, [], [pid 751] rt_sigprocmask(SIG_SETMASK, [], [pid 736] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 752] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 751] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 736] <... futex resumed>) = 0 [pid 752] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] memfd_create("syzkaller", 0 [pid 736] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] <... memfd_create resumed>) = 3 [pid 751] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 751] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 750] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 752] <... futex resumed>) = 0 [pid 751] munmap(0x7f0c41dcd000, 138412032 [pid 750] <... futex resumed>) = 1 [pid 752] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 751] <... munmap resumed>) = 0 [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 752] <... open resumed>) = 4 [pid 751] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 752] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 751] <... openat resumed>) = 5 [pid 752] <... futex resumed>) = 1 [pid 751] ioctl(5, LOOP_SET_FD, 3 [pid 750] <... futex resumed>) = 0 [pid 752] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] <... ioctl resumed>) = 0 [pid 750] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] exit_group(0 [pid 752] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 751] close(3 [pid 750] <... futex resumed>) = 0 [pid 752] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 751] <... close resumed>) = 0 [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 752] <... mount resumed>) = 0 [pid 751] mkdir("./bus", 0777 [pid 752] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 751] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 752] <... futex resumed>) = 1 [pid 751] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 750] <... futex resumed>) = 0 [pid 752] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 750] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 752] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 750] <... futex resumed>) = 0 [pid 752] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] <... exit_group resumed>) = ? [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=727, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 752] <... open resumed>) = 3 [pid 743] <... futex resumed>) = ? [pid 736] <... futex resumed>) = ? [pid 752] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 750] <... futex resumed>) = 0 [pid 743] +++ exited with 0 +++ [pid 752] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 750] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 736] +++ exited with 0 +++ [pid 752] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 750] <... futex resumed>) = 0 [pid 752] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] +++ exited with 0 +++ [pid 752] <... write resumed>) = 8 [pid 295] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=731, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 752] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 752] <... futex resumed>) = 1 [pid 750] <... futex resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 295] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 752] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 750] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 750] <... futex resumed>) = 0 [pid 295] newfstatat(3, "", [pid 750] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... restart_syscall resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 752] <... write resumed>) = 1045 [pid 752] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 752] <... futex resumed>) = 1 [pid 750] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 746] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 751] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 298] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 751] ioctl(5, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = 0 [pid 751] <... ioctl resumed>) = 0 [pid 298] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 752] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] close(5 [pid 746] ioctl(4, LOOP_CLR_FD [pid 295] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 751] <... close resumed>) = 0 [pid 746] <... ioctl resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 751] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 746] close(4 [pid 298] newfstatat(AT_FDCWD, "./14/bus", [pid 751] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 751] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 750] exit_group(0) = ? [pid 751] <... futex resumed>) = ? [pid 746] <... close resumed>) = 0 [pid 752] <... futex resumed>) = ? [pid 751] +++ exited with 0 +++ [pid 746] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./14/bus" [pid 295] <... umount2 resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 746] <... futex resumed>) = 0 [pid 746] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 737] exit_group(0 [pid 298] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 752] +++ exited with 0 +++ [pid 750] +++ exited with 0 +++ [pid 298] unlink("./14/binderfs" [pid 747] <... futex resumed>) = ? [pid 746] <... futex resumed>) = ? [pid 737] <... exit_group resumed>) = ? [pid 298] <... unlink resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=750, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 295] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 747] +++ exited with 0 +++ [pid 298] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./14/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [ 27.127527][ T746] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 27.150836][ T746] EXT4-fs (loop0): get root inode failed [ 27.159543][ T751] loop2: detected capacity change from 0 to 512 [ 27.163784][ T746] EXT4-fs (loop0): mount failed [ 27.176308][ T751] EXT4-fs (loop2): fragment/cluster size (0) != block size (4096) [pid 295] unlink("./14/bus" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... unlink resumed>) = 0 [pid 296] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [ 27.199142][ T739] EXT4-fs (loop5): 1 orphan inode deleted [ 27.199811][ T741] EXT4-fs (loop3): 1 orphan inode deleted [ 27.205610][ T739] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.211175][ T741] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.231877][ T739] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/15/file1 supports timestamps until 2038 (0x7fffffff) [pid 295] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 746] +++ exited with 0 +++ [pid 739] <... mount resumed>) = 0 [pid 737] +++ exited with 0 +++ [pid 296] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(3, "", [pid 295] newfstatat(AT_FDCWD, "./14/binderfs", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=737, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 296] getdents64(3, [pid 295] unlink("./14/binderfs" [pid 294] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 294] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... openat resumed>) = 3 [pid 295] close(3 [pid 294] newfstatat(3, "", [pid 295] <... close resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] rmdir("./14" [pid 294] getdents64(3, [pid 295] <... rmdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] mkdir("./15", 0777 [pid 294] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 757 [pid 739] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 739] chdir("./file1") = 0 [pid 739] ioctl(6, LOOP_CLR_FD) = 0 [pid 739] close(6) = 0 [pid 739] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 296] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 738] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 740] <... futex resumed>) = ? [pid 738] <... exit_group resumed>) = ? [pid 296] newfstatat(AT_FDCWD, "./15/bus", [pid 294] newfstatat(AT_FDCWD, "./15/bus", [pid 740] +++ exited with 0 +++ [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./15/bus" [pid 294] unlink("./15/bus" [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 296] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./15/binderfs", [pid 294] newfstatat(AT_FDCWD, "./15/binderfs", [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./15/binderfs" [pid 294] unlink("./15/binderfs"./strace-static-x86_64: Process 757 attached [pid 739] <... futex resumed>) = ? [pid 757] set_robust_list(0x555556d8d6a0, 24 [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 296] getdents64(3, [pid 294] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] close(3 [pid 294] newfstatat(AT_FDCWD, "./15/file1", [pid 296] <... close resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] rmdir("./15" [pid 294] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 739] +++ exited with 0 +++ [pid 738] +++ exited with 0 +++ [pid 296] <... rmdir resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=738, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 296] mkdir("./16", 0777 [pid 294] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 757] <... set_robust_list resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 294] <... openat resumed>) = 4 [pid 757] chdir("./15" [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] newfstatat(4, "", [pid 757] <... chdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 757] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 757] <... prctl resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 757] setpgid(0, 0 [pid 299] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] getdents64(4, [pid 757] <... setpgid resumed>) = 0 [pid 741] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] close(3 [pid 741] ioctl(4, LOOP_CLR_FD [pid 299] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... close resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 741] <... ioctl resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] getdents64(4, [pid 741] close(4 [pid 299] newfstatat(3, "", [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 741] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 758 [pid 294] close(4 [pid 741] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] exit_group(0 [pid 299] getdents64(3, [pid 294] <... close resumed>) = 0 [pid 744] <... futex resumed>) = ? [pid 741] <... futex resumed>) = ? [pid 733] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] rmdir("./15/file1" [pid 757] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 744] +++ exited with 0 +++ [pid 741] +++ exited with 0 +++ [pid 299] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 294] getdents64(3, [pid 299] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] close(3 [pid 299] newfstatat(AT_FDCWD, "./15/bus", [pid 294] <... close resumed>) = 0 [pid 757] <... openat resumed>) = 3 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] rmdir("./15" [pid 757] write(3, "1000", 4 [pid 299] unlink("./15/bus" [pid 294] <... rmdir resumed>) = 0 [pid 757] <... write resumed>) = 4 [pid 299] <... unlink resumed>) = 0 [pid 294] mkdir("./16", 0777./strace-static-x86_64: Process 758 attached [pid 757] close(3 [pid 299] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... mkdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 757] <... close resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./15/binderfs", [pid 294] <... openat resumed>) = 3 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] unlink("./15/binderfs" [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 758] set_robust_list(0x555556d8d6a0, 24 [pid 757] symlink("/dev/binderfs", "./binderfs" [pid 299] <... unlink resumed>) = 0 [pid 294] close(3 [pid 758] <... set_robust_list resumed>) = 0 [pid 757] <... symlink resumed>) = 0 [pid 299] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 758] chdir("./16" [pid 757] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... close resumed>) = 0 [pid 758] <... chdir resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 758] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 757] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 758] <... prctl resumed>) = 0 [pid 757] <... rt_sigaction resumed>NULL, 8) = 0 [pid 758] setpgid(0, 0 [pid 757] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 758] <... setpgid resumed>) = 0 [pid 757] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 758] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 757] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 758] <... openat resumed>) = 3 [pid 757] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 758] write(3, "1000", 4 [pid 757] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 759 [pid 758] <... write resumed>) = 4 [pid 757] <... mprotect resumed>) = 0 [pid 758] close(3 [pid 757] rt_sigprocmask(SIG_BLOCK, ~[], [pid 758] <... close resumed>) = 0 [pid 757] <... rt_sigprocmask resumed>[], 8) = 0 [pid 758] symlink("/dev/binderfs", "./binderfs" [pid 757] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 758] <... symlink resumed>) = 0 [pid 758] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... clone3 resumed> => {parent_tid=[760]}, 88) = 760 [pid 758] <... futex resumed>) = 0 [pid 757] rt_sigprocmask(SIG_SETMASK, [], [pid 758] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 757] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 758] <... rt_sigaction resumed>NULL, 8) = 0 [pid 757] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 758] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 757] <... futex resumed>) = 0 [pid 758] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 758] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 757] <... futex resumed>) = 0 [pid 758] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 757] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 758] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 757] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 758] <... mprotect resumed>) = 0 [pid 757] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 758] rt_sigprocmask(SIG_BLOCK, ~[], [pid 757] <... mprotect resumed>) = 0 [pid 758] <... rt_sigprocmask resumed>[], 8) = 0 [pid 757] rt_sigprocmask(SIG_BLOCK, ~[], [pid 758] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 757] <... rt_sigprocmask resumed>[], 8) = 0 [pid 757] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 758] <... clone3 resumed> => {parent_tid=[761]}, 88) = 761 [pid 758] rt_sigprocmask(SIG_SETMASK, [], [pid 757] <... clone3 resumed> => {parent_tid=[762]}, 88) = 762 [pid 758] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 757] rt_sigprocmask(SIG_SETMASK, [], [pid 758] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 758] <... futex resumed>) = 0 [pid 757] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 758] <... futex resumed>) = 0 [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 758] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 758] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 758] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 758] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[763]}, 88) = 763 [pid 758] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 758] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 759 attached [pid 759] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 759] chdir("./16") = 0 [pid 759] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 759] setpgid(0, 0) = 0 [pid 759] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 759] write(3, "1000", 4) = 4 [pid 759] close(3) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 759] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 763 attached ./strace-static-x86_64: Process 762 attached ./strace-static-x86_64: Process 761 attached ./strace-static-x86_64: Process 760 attached ) = 0 [pid 733] +++ exited with 0 +++ [pid 298] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 763] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 762] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 761] set_robust_list(0x7f0c4a20e9a0, 24 [pid 760] set_robust_list(0x7f0c4a20e9a0, 24 [pid 759] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=733, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 763] <... set_robust_list resumed>) = 0 [pid 762] <... set_robust_list resumed>) = 0 [pid 761] <... set_robust_list resumed>) = 0 [pid 760] <... set_robust_list resumed>) = 0 [pid 759] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./14/file1", [pid 763] rt_sigprocmask(SIG_SETMASK, [], [pid 762] rt_sigprocmask(SIG_SETMASK, [], [pid 761] rt_sigprocmask(SIG_SETMASK, [], [pid 760] rt_sigprocmask(SIG_SETMASK, [], [pid 759] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 27.232484][ T741] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/15/bus supports timestamps until 2038 (0x7fffffff) [pid 763] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 762] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 761] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 760] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 759] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 763] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 762] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 761] memfd_create("syzkaller", 0 [pid 760] memfd_create("syzkaller", 0 [pid 759] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 763] <... open resumed>) = 3 [pid 762] <... open resumed>) = 3 [pid 761] <... memfd_create resumed>) = 4 [pid 760] <... memfd_create resumed>) = 4 [pid 759] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 763] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 760] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 759] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... openat resumed>) = 4 [pid 297] <... openat resumed>) = 3 [pid 763] <... futex resumed>) = 1 [pid 762] <... futex resumed>) = 1 [pid 761] <... mmap resumed>) = 0x7f0c41dcd000 [pid 760] <... mmap resumed>) = 0x7f0c41dcd000 [pid 759] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 758] <... futex resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 298] newfstatat(4, "", [pid 297] newfstatat(3, "", [pid 763] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 762] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 758] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 758] <... futex resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 761] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 763] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 762] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 761] <... write resumed>) = 262144 [pid 760] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 759] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 297] getdents64(3, [pid 763] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 762] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 762] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 297] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 762] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(AT_FDCWD, "./15/file1", [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 763] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 762] <... futex resumed>) = 1 [pid 761] munmap(0x7f0c41dcd000, 138412032 [pid 760] <... write resumed>) = 262144 [pid 759] <... mprotect resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] close(4 [pid 297] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 763] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 761] <... munmap resumed>) = 0 [pid 760] munmap(0x7f0c41dcd000, 138412032 [pid 759] rt_sigprocmask(SIG_BLOCK, ~[], [pid 757] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 763] <... futex resumed>) = 1 [pid 762] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 761] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 758] <... futex resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] rmdir("./14/file1" [pid 297] newfstatat(AT_FDCWD, "./15/bus", [pid 763] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 762] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 761] <... openat resumed>) = 5 [pid 760] <... munmap resumed>) = 0 [pid 759] <... rt_sigprocmask resumed>[], 8) = 0 [pid 758] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 763] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 762] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 761] ioctl(5, LOOP_SET_FD, 4 [pid 760] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 759] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 758] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 763] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 762] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 760] <... openat resumed>) = 5 [pid 299] newfstatat(4, "", [pid 298] getdents64(3, [pid 297] unlink("./15/bus" [pid 763] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 762] <... futex resumed>) = 1 [pid 760] ioctl(5, LOOP_SET_FD, 4 [pid 759] <... clone3 resumed> => {parent_tid=[764]}, 88) = 764 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 764 attached [pid 763] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 761] <... ioctl resumed>) = 0 [pid 760] <... ioctl resumed>) = 0 [pid 759] rt_sigprocmask(SIG_SETMASK, [], [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 757] <... futex resumed>) = 0 [pid 299] getdents64(4, [pid 298] close(3 [pid 297] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 764] set_robust_list(0x7f0c4a20e9a0, 24 [pid 763] <... futex resumed>) = 0 [pid 761] close(4 [pid 760] close(4 [pid 759] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 758] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 757] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 764] <... set_robust_list resumed>) = 0 [pid 763] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 762] <... futex resumed>) = 0 [pid 761] <... close resumed>) = 0 [pid 760] <... close resumed>) = 0 [pid 759] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 758] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 1 [pid 299] getdents64(4, [pid 298] rmdir("./14" [pid 297] newfstatat(AT_FDCWD, "./15/binderfs", [pid 764] rt_sigprocmask(SIG_SETMASK, [], [pid 763] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 762] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 761] mkdir("./file1", 0777 [pid 760] mkdir("./file1", 0777 [pid 759] <... futex resumed>) = 0 [pid 758] <... futex resumed>) = 0 [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 764] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 762] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 761] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 763] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 762] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 764] memfd_create("syzkaller", 0 [pid 760] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(4 [pid 298] mkdir("./15", 0777 [pid 297] unlink("./15/binderfs" [pid 763] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 762] <... futex resumed>) = 1 [pid 760] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 759] <... futex resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 764] <... memfd_create resumed>) = 3 [pid 763] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 757] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./15/file1" [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] getdents64(3, [pid 764] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 763] <... futex resumed>) = 1 [pid 762] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 758] <... futex resumed>) = 0 [pid 757] <... futex resumed>) = 0 [pid 764] <... mmap resumed>) = 0x7f0c41dcd000 [pid 757] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 763] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 762] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 759] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 758] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 763] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 762] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 759] <... mprotect resumed>) = 0 [pid 758] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 763] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 759] rt_sigprocmask(SIG_BLOCK, ~[], [pid 758] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 763] <... futex resumed>) = 0 [pid 762] <... futex resumed>) = 1 [pid 759] <... rt_sigprocmask resumed>[], 8) = 0 [pid 758] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 757] <... futex resumed>) = 0 [pid 299] close(3 [pid 298] close(3 [pid 297] rmdir("./15" [pid 764] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 763] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 762] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 299] rmdir("./15" [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] mkdir("./16", 0777 [pid 759] <... clone3 resumed> => {parent_tid=[765]}, 88) = 765 [pid 299] <... rmdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 759] rt_sigprocmask(SIG_SETMASK, [], [pid 299] mkdir("./16", 0777 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 766 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 759] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 759] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] ioctl(3, LOOP_CLR_FD [pid 759] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 299] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 768 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 769 ./strace-static-x86_64: Process 768 attached [pid 768] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 768] chdir("./16") = 0 [pid 768] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 768] setpgid(0, 0) = 0 [pid 768] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 768] write(3, "1000", 4) = 4 [pid 768] close(3) = 0 [pid 768] symlink("/dev/binderfs", "./binderfs") = 0 [pid 768] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 769 attached ) = 0 [pid 768] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 769] set_robust_list(0x555556d8d6a0, 24 [pid 768] <... rt_sigaction resumed>NULL, 8) = 0 [pid 768] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 769] <... set_robust_list resumed>) = 0 [pid 768] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 764] <... write resumed>) = 262144 [pid 764] munmap(0x7f0c41dcd000, 138412032 [pid 768] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 769] chdir("./16" [pid 768] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 769] <... chdir resumed>) = 0 [pid 768] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 769] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 768] <... mprotect resumed>) = 0 [pid 769] <... prctl resumed>) = 0 [pid 768] rt_sigprocmask(SIG_BLOCK, ~[], [pid 769] setpgid(0, 0 [pid 768] <... rt_sigprocmask resumed>[], 8) = 0 [pid 769] <... setpgid resumed>) = 0 [pid 768] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 769] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 768] <... clone3 resumed> => {parent_tid=[771]}, 88) = 771 [pid 769] write(3, "1000", 4 [pid 768] rt_sigprocmask(SIG_SETMASK, [], [pid 769] <... write resumed>) = 4 [pid 768] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 769] close(3 [pid 768] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... close resumed>) = 0 [pid 768] <... futex resumed>) = 0 [pid 769] symlink("/dev/binderfs", "./binderfs" [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... symlink resumed>) = 0 [pid 768] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 768] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 764] <... munmap resumed>) = 0 [pid 769] <... futex resumed>) = 0 [pid 768] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 769] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 768] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 769] <... rt_sigaction resumed>NULL, 8) = 0 [pid 768] <... mprotect resumed>) = 0 [pid 764] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 769] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 768] rt_sigprocmask(SIG_BLOCK, ~[], [pid 769] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 768] <... rt_sigprocmask resumed>[], 8) = 0 [pid 769] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 768] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 769] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 769] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 768] <... clone3 resumed> => {parent_tid=[774]}, 88) = 774 [pid 769] <... mprotect resumed>) = 0 [pid 768] rt_sigprocmask(SIG_SETMASK, [], [pid 769] rt_sigprocmask(SIG_BLOCK, ~[], [pid 768] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 769] <... rt_sigprocmask resumed>[], 8) = 0 [pid 768] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 768] <... futex resumed>) = 0 [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 775 attached ./strace-static-x86_64: Process 774 attached ./strace-static-x86_64: Process 771 attached ./strace-static-x86_64: Process 766 attached ./strace-static-x86_64: Process 765 attached [pid 769] <... clone3 resumed> => {parent_tid=[775]}, 88) = 775 [pid 764] <... openat resumed>) = 4 [pid 775] set_robust_list(0x7f0c4a20e9a0, 24 [pid 774] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 771] set_robust_list(0x7f0c4a20e9a0, 24 [ 27.332745][ T761] loop2: detected capacity change from 0 to 512 [ 27.334519][ T760] loop1: detected capacity change from 0 to 512 [pid 766] set_robust_list(0x555556d8d6a0, 24 [pid 765] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 764] ioctl(4, LOOP_SET_FD, 3 [pid 775] <... set_robust_list resumed>) = 0 [pid 774] <... set_robust_list resumed>) = 0 [pid 771] <... set_robust_list resumed>) = 0 [pid 766] <... set_robust_list resumed>) = 0 [pid 765] <... set_robust_list resumed>) = 0 [pid 775] rt_sigprocmask(SIG_SETMASK, [], [pid 774] rt_sigprocmask(SIG_SETMASK, [], [pid 771] rt_sigprocmask(SIG_SETMASK, [], [pid 766] chdir("./15" [pid 765] rt_sigprocmask(SIG_SETMASK, [], [pid 775] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 774] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 771] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 766] <... chdir resumed>) = 0 [pid 765] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 775] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 774] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 771] memfd_create("syzkaller", 0 [pid 766] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 765] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 774] <... open resumed>) = 3 [pid 771] <... memfd_create resumed>) = 4 [pid 766] <... prctl resumed>) = 0 [pid 765] <... open resumed>) = 5 [pid 774] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 766] setpgid(0, 0 [pid 765] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 774] <... futex resumed>) = 0 [pid 771] <... mmap resumed>) = 0x7f0c41dcd000 [pid 769] rt_sigprocmask(SIG_SETMASK, [], [pid 768] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 766] <... setpgid resumed>) = 0 [pid 765] <... futex resumed>) = 1 [pid 759] <... futex resumed>) = 0 [pid 774] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 771] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 766] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 765] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... write resumed>) = 262144 [pid 766] <... openat resumed>) = 3 [pid 765] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... futex resumed>) = 0 [pid 771] munmap(0x7f0c41dcd000, 138412032 [pid 766] write(3, "1000", 4 [pid 765] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 771] <... munmap resumed>) = 0 [pid 766] <... write resumed>) = 4 [pid 765] <... mount resumed>) = 0 [pid 771] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 766] close(3 [pid 765] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... openat resumed>) = 5 [pid 766] <... close resumed>) = 0 [pid 765] <... futex resumed>) = 1 [pid 759] <... futex resumed>) = 0 [pid 771] ioctl(5, LOOP_SET_FD, 4 [pid 766] symlink("/dev/binderfs", "./binderfs" [pid 765] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 768] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] <... symlink resumed>) = 0 [pid 765] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... futex resumed>) = 0 [pid 766] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 765] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 766] <... futex resumed>) = 0 [pid 766] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 766] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 766] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 766] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 766] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 766] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[776]}, 88) = 776 [pid 766] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 766] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 766] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 766] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 766] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 766] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 765] <... open resumed>) = 6 [pid 764] <... ioctl resumed>) = 0 [pid 765] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] <... clone3 resumed> => {parent_tid=[777]}, 88) = 777 [pid 765] <... futex resumed>) = 1 [pid 764] close(3 [pid 759] <... futex resumed>) = 0 [pid 766] rt_sigprocmask(SIG_SETMASK, [], [pid 765] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 764] <... close resumed>) = 0 [pid 759] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 765] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 764] mkdir("./bus", 0777 [pid 759] <... futex resumed>) = 0 [pid 766] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 765] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 764] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 766] <... futex resumed>) = 0 [pid 765] <... write resumed>) = 8 [pid 764] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 774] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 768] <... futex resumed>) = 1 [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 765] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 774] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 765] <... futex resumed>) = 1 [pid 759] <... futex resumed>) = 0 ./strace-static-x86_64: Process 776 attached [pid 774] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 765] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] set_robust_list(0x7f0c4a20e9a0, 24 [pid 774] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 765] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... futex resumed>) = 0 [pid 776] <... set_robust_list resumed>) = 0 [pid 774] <... futex resumed>) = 0 [pid 765] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 759] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] rt_sigprocmask(SIG_SETMASK, [], [pid 774] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 765] <... write resumed>) = 1045 ./strace-static-x86_64: Process 777 attached [pid 776] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 765] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 776] memfd_create("syzkaller", 0 [pid 765] <... futex resumed>) = 1 [pid 759] <... futex resumed>) = 0 [ 27.376737][ T760] EXT4-fs (loop1): 1 orphan inode deleted [ 27.378145][ T764] loop0: detected capacity change from 0 to 512 [ 27.383315][ T761] EXT4-fs (loop2): 1 orphan inode deleted [ 27.395008][ T760] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.402827][ T771] loop3: detected capacity change from 0 to 512 [ 27.407148][ T761] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 777] <... set_robust_list resumed>) = 0 [pid 776] <... memfd_create resumed>) = 3 [pid 765] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] rt_sigprocmask(SIG_SETMASK, [], [pid 776] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 777] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 776] <... mmap resumed>) = 0x7f0c41dcd000 [pid 777] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 776] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 777] <... open resumed>) = 4 [pid 777] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 766] <... futex resumed>) = 0 [pid 777] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 766] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] <... mount resumed>) = 0 [pid 766] <... futex resumed>) = 0 [pid 777] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 777] <... futex resumed>) = 0 [pid 766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 777] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 766] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] <... open resumed>) = 5 [pid 766] <... futex resumed>) = 0 [pid 777] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 777] <... futex resumed>) = 0 [pid 766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 777] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 766] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 776] <... write resumed>) = 262144 [pid 766] <... futex resumed>) = 0 [pid 777] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 777] <... futex resumed>) = 0 [pid 776] munmap(0x7f0c41dcd000, 138412032 [pid 766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 777] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 776] <... munmap resumed>) = 0 [pid 766] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 766] <... futex resumed>) = 0 [pid 777] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 775] <... futex resumed>) = 0 [pid 769] <... futex resumed>) = 1 [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 766] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 777] <... futex resumed>) = 0 [pid 776] <... openat resumed>) = 6 [pid 775] memfd_create("syzkaller", 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 777] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 776] ioctl(6, LOOP_SET_FD, 3 [pid 775] <... memfd_create resumed>) = 3 [pid 775] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 771] <... ioctl resumed>) = 0 [pid 769] <... futex resumed>) = 0 [pid 768] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 771] close(4 [pid 769] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 768] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... close resumed>) = 0 [pid 769] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 768] <... futex resumed>) = 1 [pid 771] mkdir("./file1", 0777 [pid 769] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 771] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 769] <... mprotect resumed>) = 0 [pid 771] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 769] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 769] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 774] <... futex resumed>) = 0 [pid 769] <... clone3 resumed> => {parent_tid=[780]}, 88) = 780 [pid 769] rt_sigprocmask(SIG_SETMASK, [], [pid 775] <... mmap resumed>) = 0x7f0c41dcd000 [pid 774] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 769] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 774] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 769] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 775] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 774] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 768] <... futex resumed>) = 0 [pid 774] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 768] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 768] <... futex resumed>) = 0 [pid 774] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 774] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 775] <... write resumed>) = 262144 [pid 774] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] <... ioctl resumed>) = 0 [pid 775] munmap(0x7f0c41dcd000, 138412032 [pid 774] <... futex resumed>) = 1 [pid 768] <... futex resumed>) = 0 [pid 776] close(3 [pid 775] <... munmap resumed>) = 0 [pid 774] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 768] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 760] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 776] <... close resumed>) = 0 [pid 775] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 768] <... futex resumed>) = 0 [pid 775] <... openat resumed>) = 4 [pid 774] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 768] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 775] ioctl(4, LOOP_SET_FD, 3 [pid 776] mkdir("./bus", 0777 [pid 774] <... write resumed>) = -1 EBADF (Bad file descriptor) [ 27.423760][ T760] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/15/file1 supports timestamps until 2038 (0x7fffffff) [ 27.436193][ T761] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/16/file1 supports timestamps until 2038 (0x7fffffff) [ 27.437041][ T776] loop4: detected capacity change from 0 to 512 [ 27.459937][ T775] loop5: detected capacity change from 0 to 512 [pid 760] ioctl(5, LOOP_CLR_FD./strace-static-x86_64: Process 780 attached [pid 776] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 775] <... ioctl resumed>) = 0 [pid 774] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 780] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 780] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 780] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 780] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 780] <... futex resumed>) = 1 [pid 780] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 780] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 780] <... futex resumed>) = 1 [pid 780] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 776] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 774] <... futex resumed>) = 1 [pid 768] <... futex resumed>) = 0 [pid 774] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 775] close(3) = 0 [pid 775] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 775] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 780] <... open resumed>) = 3 [pid 780] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 780] <... futex resumed>) = 1 [pid 780] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 780] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... futex resumed>) = 0 [pid 769] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 769] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 780] <... futex resumed>) = 1 [pid 780] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = 1045 [pid 780] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] <... futex resumed>) = 0 [pid 780] <... futex resumed>) = 1 [ 27.463126][ T764] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 27.479217][ T764] EXT4-fs (loop0): get root inode failed [ 27.487872][ T764] EXT4-fs (loop0): mount failed [ 27.494937][ T771] EXT4-fs (loop3): 1 orphan inode deleted [ 27.496372][ T775] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 27.500752][ T771] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 780] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 764] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 760] <... ioctl resumed>) = 0 [pid 764] ioctl(4, LOOP_CLR_FD [pid 760] close(5) = 0 [pid 764] <... ioctl resumed>) = 0 [pid 764] close(4) = 0 [pid 761] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 760] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 764] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 764] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 761] ioctl(5, LOOP_CLR_FD [pid 760] <... futex resumed>) = 0 [pid 760] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] exit_group(0 [pid 765] <... futex resumed>) = ? [pid 764] <... futex resumed>) = ? [pid 759] <... exit_group resumed>) = ? [pid 765] +++ exited with 0 +++ [pid 764] +++ exited with 0 +++ [pid 759] +++ exited with 0 +++ [pid 757] exit_group(0 [pid 762] <... futex resumed>) = ? [pid 760] <... futex resumed>) = ? [pid 757] <... exit_group resumed>) = ? [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=759, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 762] +++ exited with 0 +++ [pid 760] +++ exited with 0 +++ [pid 757] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=757, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 775] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 294] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 775] ioctl(4, LOOP_CLR_FD) = 0 [pid 775] close(4) = 0 [pid 775] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 775] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 769] exit_group(0) = ? [pid 780] <... futex resumed>) = ? [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 780] +++ exited with 0 +++ [pid 294] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 775] <... futex resumed>) = ? [pid 294] newfstatat(3, "", [pid 295] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 295] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... openat resumed>) = 3 [pid 295] newfstatat(3, "", [pid 294] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./16/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./16/bus" [pid 771] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 771] ioctl(5, LOOP_CLR_FD [pid 776] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 776] ioctl(6, LOOP_CLR_FD) = 0 [pid 776] close(6) = 0 [pid 776] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 776] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 766] exit_group(0 [pid 777] <... futex resumed>) = ? [pid 776] <... futex resumed>) = ? [pid 766] <... exit_group resumed>) = ? [pid 777] +++ exited with 0 +++ [pid 761] <... ioctl resumed>) = 0 [pid 761] close(5) = 0 [pid 761] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 761] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 758] exit_group(0) = ? [pid 763] <... futex resumed>) = 230 [pid 763] +++ exited with 0 +++ [pid 761] <... futex resumed>) = ? [pid 761] +++ exited with 0 +++ [pid 758] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=758, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 27.515400][ T776] EXT4-fs (loop4): 1 orphan inode deleted [ 27.525785][ T771] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/16/file1 supports timestamps until 2038 (0x7fffffff) [ 27.531679][ T776] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.542097][ T775] EXT4-fs (loop5): get root inode failed [ 27.559058][ T775] EXT4-fs (loop5): mount failed [ 27.563152][ T776] ext4 filesystem being mounted at /root/syzkaller.qPQybd/15/bus supports timestamps until 2038 (0x7fffffff) [pid 296] getdents64(3, [pid 776] +++ exited with 0 +++ [pid 775] +++ exited with 0 +++ [pid 771] <... ioctl resumed>) = 0 [pid 769] +++ exited with 0 +++ [pid 766] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] <... unlink resumed>) = 0 [pid 771] close(5 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=769, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=766, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 771] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 771] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./16/binderfs", [pid 295] newfstatat(AT_FDCWD, "./15/binderfs", [pid 294] newfstatat(AT_FDCWD, "./16/binderfs", [pid 771] <... futex resumed>) = 0 [pid 299] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 771] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] unlink("./16/binderfs" [pid 295] unlink("./15/binderfs" [pid 294] unlink("./16/binderfs" [pid 768] exit_group(0 [pid 299] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 774] <... futex resumed>) = ? [pid 771] <... futex resumed>) = ? [pid 768] <... exit_group resumed>) = ? [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 296] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(3, [pid 774] +++ exited with 0 +++ [pid 771] +++ exited with 0 +++ [pid 298] newfstatat(3, "", [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] close(3 [pid 298] getdents64(3, [pid 294] <... close resumed>) = 0 [pid 768] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] rmdir("./16" [pid 299] newfstatat(3, "", [pid 298] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=768, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... rmdir resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./16/file1", [pid 295] newfstatat(AT_FDCWD, "./15/file1", [pid 294] mkdir("./17", 0777 [pid 299] getdents64(3, [pid 298] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./16/file1" [pid 295] unlink("./15/file1" [pid 294] <... mkdir resumed>) = 0 [pid 299] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./15/bus", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] <... umount2 resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 299] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./15/bus" [pid 297] <... openat resumed>) = 3 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 297] newfstatat(3, "", [pid 296] close(3 [pid 295] close(3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] newfstatat(AT_FDCWD, "./16/bus", [pid 298] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] getdents64(3, [pid 296] rmdir("./16" [pid 295] rmdir("./15" [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] unlink("./16/bus" [pid 298] newfstatat(AT_FDCWD, "./15/binderfs", [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] close(3 [pid 299] <... unlink resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] mkdir("./17", 0777 [pid 295] mkdir("./16", 0777 [pid 299] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./15/binderfs" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./16/binderfs", [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] newfstatat(AT_FDCWD, "./16/binderfs", [pid 298] getdents64(3, [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] unlink("./16/binderfs" [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] unlink("./16/binderfs" [pid 298] close(3 [pid 297] <... unlink resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... unlink resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] close(3 [pid 295] close(3 [pid 299] getdents64(3, [pid 298] rmdir("./15" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 788 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./16/file1", [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] close(3 [pid 298] mkdir("./16", 0777 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] unlink("./16/file1" [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 789 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 790 [pid 299] rmdir("./16" [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... unlink resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] getdents64(3, [pid 299] mkdir("./17", 0777 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./16" [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... rmdir resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] mkdir("./17", 0777 [pid 299] close(3 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 791 [pid 297] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 788 attached [pid 299] <... close resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... openat resumed>) = 3 [pid 788] set_robust_list(0x555556d8d6a0, 24 [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 792 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 788] <... set_robust_list resumed>) = 0 [pid 297] close(3./strace-static-x86_64: Process 791 attached [pid 788] chdir("./17" [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 790 attached [pid 791] set_robust_list(0x555556d8d6a0, 24 [pid 788] <... chdir resumed>) = 0 [pid 790] set_robust_list(0x555556d8d6a0, 24 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 793 [pid 790] <... set_robust_list resumed>) = 0 [pid 790] chdir("./16") = 0 [pid 790] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 789 attached ) = 0 [pid 790] setpgid(0, 0 [pid 789] set_robust_list(0x555556d8d6a0, 24 [pid 790] <... setpgid resumed>) = 0 [pid 789] <... set_robust_list resumed>) = 0 [pid 791] <... set_robust_list resumed>) = 0 [pid 790] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 789] chdir("./17" [pid 788] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 790] <... openat resumed>) = 3 [pid 789] <... chdir resumed>) = 0 [pid 790] write(3, "1000", 4 [pid 789] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 790] <... write resumed>) = 4 [pid 789] <... prctl resumed>) = 0 [pid 790] close(3 [pid 789] setpgid(0, 0./strace-static-x86_64: Process 792 attached [pid 790] <... close resumed>) = 0 [pid 789] <... setpgid resumed>) = 0 [pid 788] <... prctl resumed>) = 0 [pid 792] set_robust_list(0x555556d8d6a0, 24 [pid 791] chdir("./16" [pid 790] symlink("/dev/binderfs", "./binderfs" [pid 789] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 788] setpgid(0, 0 [pid 792] <... set_robust_list resumed>) = 0 [pid 791] <... chdir resumed>) = 0 [pid 790] <... symlink resumed>) = 0 [pid 789] <... openat resumed>) = 3 [pid 788] <... setpgid resumed>) = 0 [pid 792] chdir("./17" [pid 791] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 790] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] write(3, "1000", 4 [pid 788] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 792] <... chdir resumed>) = 0 [pid 791] <... prctl resumed>) = 0 [pid 790] <... futex resumed>) = 0 [pid 789] <... write resumed>) = 4 [pid 788] <... openat resumed>) = 3 ./strace-static-x86_64: Process 793 attached [pid 792] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 791] setpgid(0, 0 [pid 790] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 789] close(3 [pid 788] write(3, "1000", 4 [pid 793] set_robust_list(0x555556d8d6a0, 24 [pid 792] <... prctl resumed>) = 0 [pid 791] <... setpgid resumed>) = 0 [pid 790] <... rt_sigaction resumed>NULL, 8) = 0 [pid 789] <... close resumed>) = 0 [pid 788] <... write resumed>) = 4 [pid 793] <... set_robust_list resumed>) = 0 [pid 792] setpgid(0, 0 [pid 791] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 790] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 788] close(3 [pid 793] chdir("./17" [pid 792] <... setpgid resumed>) = 0 [pid 791] <... openat resumed>) = 3 [pid 790] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 789] symlink("/dev/binderfs", "./binderfs" [pid 788] <... close resumed>) = 0 [pid 793] <... chdir resumed>) = 0 [pid 792] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 791] write(3, "1000", 4 [pid 790] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 789] <... symlink resumed>) = 0 [pid 788] symlink("/dev/binderfs", "./binderfs" [pid 793] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 792] <... openat resumed>) = 3 [pid 791] <... write resumed>) = 4 [pid 790] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 789] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 793] <... prctl resumed>) = 0 [pid 792] write(3, "1000", 4 [pid 791] close(3 [pid 790] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 789] <... futex resumed>) = 0 [pid 788] <... symlink resumed>) = 0 [pid 793] setpgid(0, 0 [pid 792] <... write resumed>) = 4 [pid 791] <... close resumed>) = 0 [pid 790] <... mprotect resumed>) = 0 [pid 789] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 788] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 793] <... setpgid resumed>) = 0 [pid 792] close(3 [pid 791] symlink("/dev/binderfs", "./binderfs" [pid 790] rt_sigprocmask(SIG_BLOCK, ~[], [pid 789] <... rt_sigaction resumed>NULL, 8) = 0 [pid 788] <... futex resumed>) = 0 [pid 792] <... close resumed>) = 0 [pid 790] <... rt_sigprocmask resumed>[], 8) = 0 [pid 789] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 792] symlink("/dev/binderfs", "./binderfs" [pid 790] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 789] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 792] <... symlink resumed>) = 0 [pid 789] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 792] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] <... clone3 resumed> => {parent_tid=[794]}, 88) = 794 [pid 789] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 792] <... futex resumed>) = 0 [pid 790] rt_sigprocmask(SIG_SETMASK, [], [pid 789] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 788] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 793] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 792] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 791] <... symlink resumed>) = 0 [pid 790] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 789] <... mprotect resumed>) = 0 [pid 788] <... rt_sigaction resumed>NULL, 8) = 0 [pid 793] <... openat resumed>) = 3 [pid 792] <... rt_sigaction resumed>NULL, 8) = 0 [pid 790] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] rt_sigprocmask(SIG_BLOCK, ~[], [pid 788] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 792] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 791] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] <... futex resumed>) = 0 [pid 789] <... rt_sigprocmask resumed>[], 8) = 0 [pid 788] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 793] write(3, "1000", 4 [pid 792] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 791] <... futex resumed>) = 0 [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 788] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 793] <... write resumed>) = 4 [pid 792] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 791] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 790] <... futex resumed>) = 0 [pid 788] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 793] close(3 [pid 792] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 791] <... rt_sigaction resumed>NULL, 8) = 0 [pid 790] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 789] <... clone3 resumed> => {parent_tid=[795]}, 88) = 795 [pid 788] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 793] <... close resumed>) = 0 [pid 792] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 791] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 790] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 789] rt_sigprocmask(SIG_SETMASK, [], [pid 788] <... mprotect resumed>) = 0 [pid 793] symlink("/dev/binderfs", "./binderfs" [pid 792] <... mprotect resumed>) = 0 [pid 791] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 790] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 789] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 793] <... symlink resumed>) = 0 [pid 792] rt_sigprocmask(SIG_BLOCK, ~[], [pid 791] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 790] <... mprotect resumed>) = 0 [pid 789] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 794 attached [pid 793] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] <... rt_sigprocmask resumed>[], 8) = 0 [pid 791] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 790] rt_sigprocmask(SIG_BLOCK, ~[], [pid 789] <... futex resumed>) = 0 [pid 788] <... rt_sigprocmask resumed>[], 8) = 0 [pid 794] set_robust_list(0x7f0c4a20e9a0, 24 [pid 793] <... futex resumed>) = 0 [pid 792] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 791] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 790] <... rt_sigprocmask resumed>[], 8) = 0 [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 794] <... set_robust_list resumed>) = 0 [pid 793] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 791] <... mprotect resumed>) = 0 [pid 790] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 789] <... futex resumed>) = 0 ./strace-static-x86_64: Process 795 attached [pid 794] rt_sigprocmask(SIG_SETMASK, [], [pid 793] <... rt_sigaction resumed>NULL, 8) = 0 [pid 792] <... clone3 resumed> => {parent_tid=[796]}, 88) = 796 [pid 791] rt_sigprocmask(SIG_BLOCK, ~[], [pid 789] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 788] <... clone3 resumed> => {parent_tid=[797]}, 88) = 797 [pid 795] set_robust_list(0x7f0c4a20e9a0, 24 [pid 794] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 793] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 792] rt_sigprocmask(SIG_SETMASK, [], [pid 790] <... clone3 resumed> => {parent_tid=[798]}, 88) = 798 [pid 789] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 795] <... set_robust_list resumed>) = 0 [pid 794] memfd_create("syzkaller", 0 [pid 792] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 790] rt_sigprocmask(SIG_SETMASK, [], [pid 789] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 795] rt_sigprocmask(SIG_SETMASK, [], [pid 794] <... memfd_create resumed>) = 3 [pid 793] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 792] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... rt_sigprocmask resumed>[], 8) = 0 [pid 790] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 789] <... mprotect resumed>) = 0 [pid 788] rt_sigprocmask(SIG_SETMASK, [], [pid 795] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 794] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 793] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 792] <... futex resumed>) = 0 [pid 790] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] rt_sigprocmask(SIG_BLOCK, ~[], [pid 795] memfd_create("syzkaller", 0 [pid 794] <... mmap resumed>) = 0x7f0c41dcd000 [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] <... futex resumed>) = 0 [pid 789] <... rt_sigprocmask resumed>[], 8) = 0 [pid 795] <... memfd_create resumed>) = 3 [pid 794] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 793] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 792] <... futex resumed>) = 0 [pid 791] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 788] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 798 attached ./strace-static-x86_64: Process 797 attached ./strace-static-x86_64: Process 796 attached [pid 795] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 794] <... write resumed>) = 262144 [pid 793] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 792] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 788] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 798] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 796] set_robust_list(0x7f0c4a20e9a0, 24 [pid 795] <... mmap resumed>) = 0x7f0c41dcd000 [pid 794] munmap(0x7f0c41dcd000, 138412032 [pid 793] <... mprotect resumed>) = 0 [pid 792] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 791] <... clone3 resumed> => {parent_tid=[799]}, 88) = 799 [pid 789] <... clone3 resumed> => {parent_tid=[800]}, 88) = 800 [pid 788] <... futex resumed>) = 0 ./strace-static-x86_64: Process 800 attached [pid 798] <... set_robust_list resumed>) = 0 [pid 797] set_robust_list(0x7f0c4a20e9a0, 24 [pid 796] <... set_robust_list resumed>) = 0 [pid 795] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 794] <... munmap resumed>) = 0 [pid 793] rt_sigprocmask(SIG_BLOCK, ~[], [pid 792] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 791] rt_sigprocmask(SIG_SETMASK, [], [pid 789] rt_sigprocmask(SIG_SETMASK, [], [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 798] rt_sigprocmask(SIG_SETMASK, [], [pid 797] <... set_robust_list resumed>) = 0 [pid 796] rt_sigprocmask(SIG_SETMASK, [], [pid 794] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 793] <... rt_sigprocmask resumed>[], 8) = 0 [pid 792] <... mprotect resumed>) = 0 [pid 791] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 789] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 788] <... futex resumed>) = 0 [pid 798] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 797] rt_sigprocmask(SIG_SETMASK, [], [pid 796] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 795] <... write resumed>) = 262144 [pid 800] <... set_robust_list resumed>) = 0 [pid 794] <... openat resumed>) = 4 [pid 793] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 792] rt_sigprocmask(SIG_BLOCK, ~[], [pid 791] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 799 attached [pid 800] rt_sigprocmask(SIG_SETMASK, [], [pid 798] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 797] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 796] memfd_create("syzkaller", 0 [pid 795] munmap(0x7f0c41dcd000, 138412032 [pid 794] ioctl(4, LOOP_SET_FD, 3 [pid 792] <... rt_sigprocmask resumed>[], 8) = 0 [pid 791] <... futex resumed>) = 0 [pid 789] <... futex resumed>) = 0 [pid 788] <... mmap resumed>) = 0x7f0c4a1cd000 ./strace-static-x86_64: Process 801 attached [pid 800] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 799] set_robust_list(0x7f0c4a20e9a0, 24 [pid 798] <... open resumed>) = 5 [pid 797] memfd_create("syzkaller", 0 [pid 796] <... memfd_create resumed>) = 3 [pid 795] <... munmap resumed>) = 0 [pid 793] <... clone3 resumed> => {parent_tid=[801]}, 88) = 801 [pid 792] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 791] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 788] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 800] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 799] <... set_robust_list resumed>) = 0 [pid 798] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... memfd_create resumed>) = 3 [pid 796] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 795] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 793] rt_sigprocmask(SIG_SETMASK, [], [pid 791] <... futex resumed>) = 0 [pid 788] <... mprotect resumed>) = 0 [pid 801] set_robust_list(0x7f0c4a20e9a0, 24 [pid 799] rt_sigprocmask(SIG_SETMASK, [], [pid 798] <... futex resumed>) = 1 [pid 797] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 796] <... mmap resumed>) = 0x7f0c41dcd000 [pid 793] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 792] <... clone3 resumed> => {parent_tid=[802]}, 88) = 802 [pid 791] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 790] <... futex resumed>) = 0 [pid 788] rt_sigprocmask(SIG_BLOCK, ~[], [pid 795] <... openat resumed>) = 4 [pid 800] <... open resumed>) = 5 [pid 799] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 798] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] <... mmap resumed>) = 0x7f0c41dcd000 [pid 792] rt_sigprocmask(SIG_SETMASK, [], [pid 790] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 799] memfd_create("syzkaller", 0 [pid 798] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 792] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 790] <... futex resumed>) = 0 [pid 799] <... memfd_create resumed>) = 3 [pid 798] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 792] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 798] <... mount resumed>) = 0 [pid 792] <... futex resumed>) = 0 [pid 799] <... mmap resumed>) = 0x7f0c41dee000 [pid 798] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 798] <... futex resumed>) = 1 [pid 796] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 793] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... mmap resumed>) = 0x7f0c41dcd000 [pid 790] <... futex resumed>) = 0 [pid 788] <... rt_sigprocmask resumed>[], 8) = 0 [pid 797] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 795] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 802 attached [pid 801] <... set_robust_list resumed>) = 0 [pid 800] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 799] <... write resumed>) = 262144 [pid 798] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] <... write resumed>) = 262144 [pid 796] <... write resumed>) = 262144 [pid 795] <... ioctl resumed>) = 0 [pid 794] <... ioctl resumed>) = 0 [pid 793] <... futex resumed>) = 0 [pid 791] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 790] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 802] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 801] rt_sigprocmask(SIG_SETMASK, [], [pid 800] <... futex resumed>) = 1 [pid 799] munmap(0x7f0c41dee000, 138412032 [pid 798] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] <... futex resumed>) = 0 [pid 789] <... futex resumed>) = 0 [pid 791] <... mprotect resumed>) = 0 [pid 801] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 800] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 799] <... munmap resumed>) = 0 [pid 798] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 797] munmap(0x7f0c41dcd000, 138412032 [pid 796] munmap(0x7f0c41dcd000, 138412032 [pid 793] <... futex resumed>) = 0 [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] rt_sigprocmask(SIG_BLOCK, ~[], [pid 794] close(3 [pid 802] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 803 attached [pid 801] memfd_create("syzkaller", 0 [pid 800] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 799] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 798] <... open resumed>) = 6 [pid 797] <... munmap resumed>) = 0 [pid 796] <... munmap resumed>) = 0 [pid 795] close(3 [pid 793] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 791] <... rt_sigprocmask resumed>[], 8) = 0 [pid 789] <... futex resumed>) = 0 [pid 788] <... clone3 resumed> => {parent_tid=[803]}, 88) = 803 [pid 801] <... memfd_create resumed>) = 3 [pid 800] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 799] <... openat resumed>) = 4 [pid 798] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 796] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 793] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 791] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 788] rt_sigprocmask(SIG_SETMASK, [], [pid 801] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 800] <... mount resumed>) = 0 [pid 799] ioctl(4, LOOP_SET_FD, 3 [pid 798] <... futex resumed>) = 1 [pid 797] <... openat resumed>) = 4 [pid 796] <... openat resumed>) = 4 [pid 793] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 790] <... futex resumed>) = 0 [pid 803] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 802] rt_sigprocmask(SIG_SETMASK, [], [pid 801] <... mmap resumed>) = 0x7f0c41dcd000 [pid 800] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 795] <... close resumed>) = 0 [pid 794] <... close resumed>) = 0 [pid 793] <... mprotect resumed>) = 0 [pid 788] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 803] <... set_robust_list resumed>) = 0 [pid 802] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 801] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 800] <... futex resumed>) = 1 [pid 795] mkdir("./bus", 0777 [pid 794] mkdir("./bus", 0777 [pid 793] rt_sigprocmask(SIG_BLOCK, ~[], [pid 791] <... clone3 resumed> => {parent_tid=[804]}, 88) = 804 [pid 788] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 804 attached [pid 803] rt_sigprocmask(SIG_SETMASK, [], [pid 802] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 801] <... write resumed>) = 262144 [pid 800] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 799] <... ioctl resumed>) = 0 [pid 798] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] ioctl(4, LOOP_SET_FD, 3 [pid 796] ioctl(4, LOOP_SET_FD, 3 [pid 794] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 793] <... rt_sigprocmask resumed>[], 8) = 0 [pid 791] rt_sigprocmask(SIG_SETMASK, [], [pid 790] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] <... futex resumed>) = 0 [pid 788] <... futex resumed>) = 0 [pid 804] set_robust_list(0x7f0c41ded9a0, 24 [pid 803] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 802] <... open resumed>) = 5 [pid 801] munmap(0x7f0c41dcd000, 138412032 [pid 799] close(3 [pid 798] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 795] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 794] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 793] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 791] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 803] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 802] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 801] <... munmap resumed>) = 0 [pid 798] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 795] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 791] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] <... open resumed>) = 5 [pid 802] <... futex resumed>) = 1 [pid 801] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 793] <... clone3 resumed> => {parent_tid=[805]}, 88) = 805 [pid 791] <... futex resumed>) = 0 [pid 803] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 801] <... openat resumed>) = 4 [pid 793] rt_sigprocmask(SIG_SETMASK, [], [pid 791] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 803] <... futex resumed>) = 1 [pid 801] ioctl(4, LOOP_SET_FD, 3 [pid 793] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 788] <... futex resumed>) = 0 ./strace-static-x86_64: Process 805 attached [pid 804] <... set_robust_list resumed>) = 0 [pid 803] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 799] <... close resumed>) = 0 [pid 797] <... ioctl resumed>) = 0 [pid 796] <... ioctl resumed>) = 0 [pid 792] <... futex resumed>) = 0 [pid 790] <... futex resumed>) = 0 [pid 789] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 804] rt_sigprocmask(SIG_SETMASK, [], [pid 799] mkdir("./file1", 0777 [pid 797] close(3 [pid 796] close(3 [pid 792] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] <... futex resumed>) = 1 [pid 805] <... set_robust_list resumed>) = 0 [pid 804] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 799] <... mkdir resumed>) = 0 [pid 797] <... close resumed>) = 0 [pid 796] <... close resumed>) = 0 [pid 792] <... futex resumed>) = 1 [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 805] rt_sigprocmask(SIG_SETMASK, [], [pid 804] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 799] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 797] mkdir("./bus", 0777 [pid 796] mkdir("./bus", 0777 [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 805] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 804] <... open resumed>) = 3 [pid 797] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 796] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 805] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 804] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 796] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 804] <... futex resumed>) = 1 [ 27.686814][ T794] loop1: detected capacity change from 0 to 512 [ 27.700852][ T795] loop2: detected capacity change from 0 to 512 [ 27.712058][ T799] loop4: detected capacity change from 0 to 512 [ 27.719227][ T797] loop0: detected capacity change from 0 to 512 [ 27.725433][ T796] loop5: detected capacity change from 0 to 512 [pid 804] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 803] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 802] <... futex resumed>) = 0 [pid 801] <... ioctl resumed>) = 0 [pid 800] <... futex resumed>) = 0 [pid 798] <... write resumed>) = 8 [pid 793] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 788] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 802] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 801] close(3 [pid 798] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 805] <... futex resumed>) = 0 [pid 793] <... futex resumed>) = 1 [pid 791] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] <... futex resumed>) = 0 [pid 805] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 804] <... futex resumed>) = 0 [pid 802] <... mount resumed>) = 0 [pid 801] <... close resumed>) = 0 [pid 800] <... open resumed>) = 3 [pid 798] <... futex resumed>) = 1 [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 791] <... futex resumed>) = 1 [pid 790] <... futex resumed>) = 0 [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 803] <... mount resumed>) = 0 [pid 805] <... open resumed>) = 3 [pid 804] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 803] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 801] mkdir("./bus", 0777 [pid 800] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 798] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 791] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 790] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] <... mount resumed>) = 0 [pid 803] <... futex resumed>) = 1 [pid 802] <... futex resumed>) = 1 [pid 801] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 800] <... futex resumed>) = 1 [pid 798] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 792] <... futex resumed>) = 0 [pid 790] <... futex resumed>) = 0 [pid 789] <... futex resumed>) = 0 [pid 788] <... futex resumed>) = 0 [pid 805] <... futex resumed>) = 1 [pid 804] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 802] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 801] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 800] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 798] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 793] <... futex resumed>) = 0 [pid 792] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 790] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [ 27.730829][ T801] loop3: detected capacity change from 0 to 512 [ 27.743229][ T794] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 27.745011][ T797] EXT4-fs (loop0): 1 orphan inode deleted [ 27.758412][ T799] EXT4-fs (loop4): 1 orphan inode deleted [ 27.762001][ T797] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 805] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 804] <... futex resumed>) = 1 [pid 803] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 802] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 800] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 798] <... write resumed>) = 1045 [pid 793] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] <... futex resumed>) = 0 [pid 791] <... futex resumed>) = 0 [pid 789] <... futex resumed>) = 0 [pid 805] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 804] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 798] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 793] <... futex resumed>) = 0 [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 788] <... futex resumed>) = 0 [pid 805] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 803] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 802] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 800] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 791] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 803] <... open resumed>) = 3 [pid 802] <... open resumed>) = 3 [pid 791] <... futex resumed>) = 0 [pid 803] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 805] <... mount resumed>) = 0 [pid 804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 803] <... futex resumed>) = 1 [pid 802] <... futex resumed>) = 0 [pid 800] <... write resumed>) = 8 [pid 798] <... futex resumed>) = 1 [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 792] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 790] <... futex resumed>) = 0 [pid 788] <... futex resumed>) = 0 [pid 805] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 802] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 788] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 788] <... futex resumed>) = 0 [pid 803] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 805] <... futex resumed>) = 0 [pid 800] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 798] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 793] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 27.767487][ T799] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.778188][ T797] ext4 filesystem being mounted at /root/syzkaller.iF59aB/17/bus supports timestamps until 2038 (0x7fffffff) [ 27.792007][ T796] EXT4-fs (loop5): 1 orphan inode deleted [ 27.808022][ T795] EXT4-fs (loop2): 1 orphan inode deleted [ 27.811514][ T799] ext4 filesystem being mounted at /root/syzkaller.qPQybd/16/bus supports timestamps until 2038 (0x7fffffff) [ 27.814266][ T794] EXT4-fs (loop1): get root inode failed [pid 792] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 804] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 803] <... write resumed>) = 8 [pid 802] <... futex resumed>) = 0 [pid 800] <... futex resumed>) = 1 [pid 793] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] <... futex resumed>) = 1 [pid 789] <... futex resumed>) = 0 [pid 805] <... open resumed>) = 5 [pid 804] <... open resumed>) = 5 [pid 803] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 800] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 793] <... futex resumed>) = 0 [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 791] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 789] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 788] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 805] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] <... futex resumed>) = 0 [pid 802] <... write resumed>) = 8 [pid 800] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 797] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 791] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] <... futex resumed>) = 0 [pid 788] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] <... futex resumed>) = 0 [pid 803] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 802] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 797] ioctl(4, LOOP_CLR_FD [pid 793] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 791] <... futex resumed>) = 0 [pid 789] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 788] <... futex resumed>) = 0 [pid 805] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 804] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] <... write resumed>) = 1045 [pid 802] <... futex resumed>) = 1 [pid 800] <... write resumed>) = 1045 [pid 797] <... ioctl resumed>) = 0 [pid 793] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] <... futex resumed>) = 0 [pid 791] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 788] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 805] <... write resumed>) = 8 [pid 804] <... futex resumed>) = 0 [pid 803] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 800] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] close(4 [pid 794] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 793] <... futex resumed>) = 0 [pid 792] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 805] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 803] <... futex resumed>) = 1 [pid 802] <... write resumed>) = 1045 [pid 800] <... futex resumed>) = 1 [pid 797] <... close resumed>) = 0 [pid 794] ioctl(4, LOOP_CLR_FD [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 792] <... futex resumed>) = 0 [pid 791] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 789] <... futex resumed>) = 0 [pid 788] <... futex resumed>) = 0 [pid 805] <... futex resumed>) = 0 [pid 803] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 802] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 794] <... ioctl resumed>) = 0 [pid 793] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 792] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 791] <... mprotect resumed>) = 0 [pid 788] exit_group(0 [pid 805] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 803] <... futex resumed>) = ? [pid 802] <... futex resumed>) = 0 [pid 797] <... futex resumed>) = ? [pid 794] close(4 [pid 793] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 792] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 791] rt_sigprocmask(SIG_BLOCK, ~[], [pid 788] <... exit_group resumed>) = ? [pid 805] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 803] +++ exited with 0 +++ [pid 802] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] +++ exited with 0 +++ [pid 794] <... close resumed>) = 0 [pid 793] <... futex resumed>) = 0 [pid 791] <... rt_sigprocmask resumed>[], 8) = 0 [pid 805] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 794] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 793] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 791] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 790] exit_group(0 [pid 805] <... write resumed>) = 1045 [pid 798] <... futex resumed>) = ? [pid 794] <... futex resumed>) = ? [pid 790] <... exit_group resumed>) = ? [pid 805] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 798] +++ exited with 0 +++ [pid 794] +++ exited with 0 +++ [pid 791] <... clone3 resumed> => {parent_tid=[819]}, 88) = 819 [pid 805] <... futex resumed>) = 1 [pid 793] <... futex resumed>) = 0 [pid 791] rt_sigprocmask(SIG_SETMASK, [], [pid 805] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 791] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 791] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 819 attached [pid 819] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 819] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 819] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 819] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 791] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] <... futex resumed>) = 0 [pid 791] <... futex resumed>) = 1 [pid 804] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 791] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 804] <... write resumed>) = 1045 [pid 804] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 791] <... futex resumed>) = 0 [pid 804] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 819] <... futex resumed>) = 1 [ 27.826002][ T796] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.841586][ T795] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.842467][ T796] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/17/bus supports timestamps until 2038 (0x7fffffff) [ 27.855057][ T801] EXT4-fs (loop3): 1 orphan inode deleted [ 27.863989][ T794] EXT4-fs (loop1): mount failed [ 27.875029][ T795] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/17/bus supports timestamps until 2038 (0x7fffffff) [pid 819] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 796] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 799] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 796] ioctl(4, LOOP_CLR_FD [pid 799] ioctl(4, LOOP_CLR_FD [pid 796] <... ioctl resumed>) = 0 [pid 799] <... ioctl resumed>) = 0 [pid 796] close(4) = 0 [pid 799] close(4 [pid 796] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 799] <... close resumed>) = 0 [pid 796] <... futex resumed>) = 0 [pid 799] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 799] <... futex resumed>) = 0 [pid 791] exit_group(0 [pid 819] <... futex resumed>) = ? [pid 804] <... futex resumed>) = ? [pid 791] <... exit_group resumed>) = ? [pid 819] +++ exited with 0 +++ [pid 804] +++ exited with 0 +++ [pid 795] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 795] ioctl(4, LOOP_CLR_FD) = 0 [pid 795] close(4) = 0 [pid 795] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 795] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 792] exit_group(0 [pid 789] exit_group(0 [pid 802] <... futex resumed>) = ? [pid 800] <... futex resumed>) = ? [pid 792] <... exit_group resumed>) = ? [pid 789] <... exit_group resumed>) = ? [pid 802] +++ exited with 0 +++ [pid 800] +++ exited with 0 +++ [pid 796] <... futex resumed>) = ? [pid 795] <... futex resumed>) = ? [pid 790] +++ exited with 0 +++ [pid 788] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=790, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=788, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 295] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 295] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, [pid 294] getdents64(3, [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 799] +++ exited with 0 +++ [pid 791] +++ exited with 0 +++ [pid 295] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 796] +++ exited with 0 +++ [pid 792] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./16/bus", [pid 294] newfstatat(AT_FDCWD, "./17/bus", [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=792, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=791, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] unlink("./16/bus" [pid 294] unlink("./17/bus" [pid 299] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 295] newfstatat(AT_FDCWD, "./16/binderfs", [pid 294] newfstatat(AT_FDCWD, "./17/binderfs", [pid 299] newfstatat(3, "", [pid 298] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] unlink("./16/binderfs" [pid 294] unlink("./17/binderfs" [pid 299] getdents64(3, [pid 298] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] getdents64(3, [pid 294] getdents64(3, [pid 299] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 801] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 295] close(3 [pid 294] close(3 [pid 801] ioctl(4, LOOP_CLR_FD [pid 299] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 801] <... ioctl resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] rmdir("./16" [pid 294] <... close resumed>) = 0 [pid 801] close(4 [pid 299] newfstatat(AT_FDCWD, "./17/bus", [pid 298] newfstatat(AT_FDCWD, "./16/bus", [pid 801] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] rmdir("./17" [pid 801] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./17/bus" [pid 298] unlink("./16/bus" [pid 295] mkdir("./17", 0777 [pid 801] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 801] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... mkdir resumed>) = 0 [pid 793] exit_group(0 [pid 299] newfstatat(AT_FDCWD, "./17/binderfs", [pid 298] newfstatat(AT_FDCWD, "./16/binderfs", [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] mkdir("./18", 0777 [pid 805] <... futex resumed>) = ? [pid 801] <... futex resumed>) = ? [pid 793] <... exit_group resumed>) = ? [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... openat resumed>) = 3 [pid 801] +++ exited with 0 +++ [pid 299] unlink("./17/binderfs" [pid 298] unlink("./16/binderfs" [pid 805] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 299] getdents64(3, [pid 298] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 298] newfstatat(AT_FDCWD, "./16/file1", [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] rmdir("./17" [pid 298] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 294] <... openat resumed>) = 3 [pid 795] +++ exited with 0 +++ [pid 789] +++ exited with 0 +++ [pid 299] <... rmdir resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... close resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] mkdir("./18", 0777 [pid 298] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=789, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... mkdir resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] newfstatat(4, "", [pid 296] <... restart_syscall resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] close(3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] getdents64(4, [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 820 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... close resumed>) = 0 [pid 299] close(3 [pid 298] getdents64(4, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] close(4 [pid 296] <... openat resumed>) = 3 [pid 298] <... close resumed>) = 0 [pid 296] newfstatat(3, "", [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 822 [pid 298] rmdir("./16/file1" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 821 [pid 298] <... rmdir resumed>) = 0 [pid 296] getdents64(3, [pid 298] getdents64(3, [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] close(3 [pid 296] <... umount2 resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./16" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./17/bus", [pid 298] mkdir("./17", 0777 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 820 attached [pid 298] <... mkdir resumed>) = 0 [pid 296] unlink("./17/bus" [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] <... unlink resumed>) = 0 [pid 820] set_robust_list(0x555556d8d6a0, 24 [pid 298] <... openat resumed>) = 3 [pid 296] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] newfstatat(AT_FDCWD, "./17/binderfs", [pid 298] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... close resumed>) = 0 [pid 296] unlink("./17/binderfs"./strace-static-x86_64: Process 821 attached [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... unlink resumed>) = 0 [pid 821] set_robust_list(0x555556d8d6a0, 24 [pid 296] getdents64(3, [pid 821] <... set_robust_list resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 823 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 821] chdir("./18" [pid 296] close(3./strace-static-x86_64: Process 822 attached [pid 821] <... chdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 822] set_robust_list(0x555556d8d6a0, 24 [pid 821] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 820] <... set_robust_list resumed>) = 0 [pid 296] rmdir("./17" [pid 822] <... set_robust_list resumed>) = 0 [pid 821] <... prctl resumed>) = 0 [pid 820] chdir("./17" [pid 296] <... rmdir resumed>) = 0 [pid 822] chdir("./18" [pid 821] setpgid(0, 0 [pid 296] mkdir("./18", 0777 [pid 822] <... chdir resumed>) = 0 [pid 821] <... setpgid resumed>) = 0 [pid 820] <... chdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 822] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 821] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 820] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 822] <... prctl resumed>) = 0 [pid 821] <... openat resumed>) = 3 [pid 820] <... prctl resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 822] setpgid(0, 0 [pid 821] write(3, "1000", 4 [pid 296] ioctl(3, LOOP_CLR_FD [pid 822] <... setpgid resumed>) = 0 [pid 821] <... write resumed>) = 4 [pid 820] setpgid(0, 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 822] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 821] close(3 [pid 296] close(3 [pid 820] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 823 attached [pid 822] <... openat resumed>) = 3 [pid 821] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 820] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 822] write(3, "1000", 4 [pid 821] symlink("/dev/binderfs", "./binderfs" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 823] set_robust_list(0x555556d8d6a0, 24 [pid 822] <... write resumed>) = 4 [pid 821] <... symlink resumed>) = 0 [pid 820] <... openat resumed>) = 3 [pid 822] close(3 [pid 821] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] write(3, "1000", 4 [pid 823] <... set_robust_list resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 824 [pid 822] <... close resumed>) = 0 [pid 821] <... futex resumed>) = 0 [pid 820] <... write resumed>) = 4 [pid 823] chdir("./17" [pid 822] symlink("/dev/binderfs", "./binderfs" [pid 821] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 820] close(3 [pid 823] <... chdir resumed>) = 0 [pid 822] <... symlink resumed>) = 0 [pid 821] <... rt_sigaction resumed>NULL, 8) = 0 [pid 820] <... close resumed>) = 0 [pid 823] prctl(PR_SET_PDEATHSIG, SIGKILL [ 27.885832][ T801] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.899077][ T801] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/17/bus supports timestamps until 2038 (0x7fffffff) [pid 822] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 820] symlink("/dev/binderfs", "./binderfs" [pid 822] <... futex resumed>) = 0 [pid 821] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 822] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 821] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 822] <... rt_sigaction resumed>NULL, 8) = 0 [pid 821] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 822] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 821] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 822] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 821] <... mprotect resumed>) = 0 [pid 822] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 821] rt_sigprocmask(SIG_BLOCK, ~[], [pid 822] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 821] <... rt_sigprocmask resumed>[], 8) = 0 [pid 822] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 821] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 822] <... mprotect resumed>) = 0 [pid 793] +++ exited with 0 +++ [pid 823] <... prctl resumed>) = 0 [pid 822] rt_sigprocmask(SIG_BLOCK, ~[], [pid 821] <... clone3 resumed> => {parent_tid=[825]}, 88) = 825 [pid 820] <... symlink resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=793, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 823] setpgid(0, 0 [pid 822] <... rt_sigprocmask resumed>[], 8) = 0 [pid 821] rt_sigprocmask(SIG_SETMASK, [], [pid 820] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 823] <... setpgid resumed>) = 0 [pid 822] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 821] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 820] <... futex resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 823] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 821] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 823] <... openat resumed>) = 3 [pid 822] <... clone3 resumed> => {parent_tid=[826]}, 88) = 826 [pid 821] <... futex resumed>) = 0 [pid 820] <... rt_sigaction resumed>NULL, 8) = 0 [pid 823] write(3, "1000", 4 [pid 822] rt_sigprocmask(SIG_SETMASK, [], [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 823] <... write resumed>) = 4 [pid 822] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 821] <... futex resumed>) = 0 [pid 820] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 823] close(3 [pid 822] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 823] <... close resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 821] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 820] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 297] <... openat resumed>) = 3 [pid 823] symlink("/dev/binderfs", "./binderfs" [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 820] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] newfstatat(3, "", [pid 823] <... symlink resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 821] <... mprotect resumed>) = 0 [pid 820] <... mprotect resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 822] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 821] rt_sigprocmask(SIG_BLOCK, ~[], [pid 820] rt_sigprocmask(SIG_BLOCK, ~[], [pid 823] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 823] <... futex resumed>) = 0 [pid 822] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 821] <... rt_sigprocmask resumed>[], 8) = 0 [pid 820] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 823] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 822] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 821] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 820] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 823] <... rt_sigaction resumed>NULL, 8) = 0 [pid 822] <... mprotect resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 823] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 822] rt_sigprocmask(SIG_BLOCK, ~[], [pid 821] <... clone3 resumed> => {parent_tid=[827]}, 88) = 827 [pid 820] <... clone3 resumed> => {parent_tid=[828]}, 88) = 828 [pid 297] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 823] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 822] <... rt_sigprocmask resumed>[], 8) = 0 [pid 821] rt_sigprocmask(SIG_SETMASK, [], [pid 820] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 826 attached [pid 823] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 822] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 821] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 820] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./17/bus", ./strace-static-x86_64: Process 825 attached [pid 826] set_robust_list(0x7f0c4a20e9a0, 24 [pid 823] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 821] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 826] <... set_robust_list resumed>) = 0 [pid 825] set_robust_list(0x7f0c4a20e9a0, 24 [pid 823] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 822] <... clone3 resumed> => {parent_tid=[829]}, 88) = 829 [pid 821] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 297] unlink("./17/bus" [pid 826] rt_sigprocmask(SIG_SETMASK, [], [pid 825] <... set_robust_list resumed>) = 0 [pid 823] <... mprotect resumed>) = 0 [pid 822] rt_sigprocmask(SIG_SETMASK, [], [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 824 attached [pid 826] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 825] rt_sigprocmask(SIG_SETMASK, [], [pid 823] rt_sigprocmask(SIG_BLOCK, ~[], [pid 822] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 820] <... futex resumed>) = 0 [pid 297] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 826] memfd_create("syzkaller", 0 [pid 825] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 824] set_robust_list(0x555556d8d6a0, 24 [pid 823] <... rt_sigprocmask resumed>[], 8) = 0 [pid 822] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 828 attached [pid 826] <... memfd_create resumed>) = 3 [pid 825] memfd_create("syzkaller", 0 [pid 824] <... set_robust_list resumed>) = 0 [pid 823] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 822] <... futex resumed>) = 0 [pid 820] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] newfstatat(AT_FDCWD, "./17/binderfs", [pid 826] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 825] <... memfd_create resumed>) = 3 [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 820] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 824] chdir("./18" [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 828] set_robust_list(0x7f0c4a20e9a0, 24./strace-static-x86_64: Process 827 attached ) = 0 [pid 826] <... mmap resumed>) = 0x7f0c41dcd000 [pid 825] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 824] <... chdir resumed>) = 0 [pid 823] <... clone3 resumed> => {parent_tid=[830]}, 88) = 830 [pid 820] <... mprotect resumed>) = 0 [pid 297] unlink("./17/binderfs"./strace-static-x86_64: Process 829 attached [pid 828] rt_sigprocmask(SIG_SETMASK, [], [pid 827] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 826] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 825] <... mmap resumed>) = 0x7f0c41dcd000 [pid 824] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 823] rt_sigprocmask(SIG_SETMASK, [], [pid 820] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 830 attached [pid 829] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 828] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 827] <... set_robust_list resumed>) = 0 [pid 826] <... write resumed>) = 262144 [pid 825] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 824] <... prctl resumed>) = 0 [pid 823] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 820] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] getdents64(3, [pid 830] set_robust_list(0x7f0c4a20e9a0, 24 [pid 829] <... set_robust_list resumed>) = 0 [pid 828] memfd_create("syzkaller", 0 [pid 827] rt_sigprocmask(SIG_SETMASK, [], [pid 826] munmap(0x7f0c41dcd000, 138412032 [pid 825] <... write resumed>) = 262144 [pid 824] setpgid(0, 0 [pid 823] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 830] <... set_robust_list resumed>) = 0 [pid 829] rt_sigprocmask(SIG_SETMASK, [], [pid 828] <... memfd_create resumed>) = 3 [pid 827] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 826] <... munmap resumed>) = 0 [pid 825] munmap(0x7f0c41dcd000, 138412032 [pid 824] <... setpgid resumed>) = 0 [pid 823] <... futex resumed>) = 0 [pid 297] close(3 [pid 830] rt_sigprocmask(SIG_SETMASK, [], [pid 829] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 828] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 827] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 826] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 825] <... munmap resumed>) = 0 [pid 824] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 823] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... clone3 resumed> => {parent_tid=[831]}, 88) = 831 [pid 297] <... close resumed>) = 0 [pid 830] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 829] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 828] <... mmap resumed>) = 0x7f0c41dcd000 [pid 827] <... open resumed>) = 4 [pid 826] <... openat resumed>) = 4 [pid 825] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 823] <... futex resumed>) = 0 [pid 820] rt_sigprocmask(SIG_SETMASK, [], [pid 297] rmdir("./17" [pid 830] memfd_create("syzkaller", 0 [pid 829] <... open resumed>) = 5 [pid 826] ioctl(4, LOOP_SET_FD, 3 [pid 825] <... openat resumed>) = 5 [pid 824] <... openat resumed>) = 3 [pid 297] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 831 attached [pid 830] <... memfd_create resumed>) = 3 [pid 829] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 828] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 827] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] write(3, "1000", 4 [pid 823] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 820] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 831] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 830] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 829] <... futex resumed>) = 1 [pid 826] <... ioctl resumed>) = 0 [pid 825] ioctl(5, LOOP_SET_FD, 3 [pid 822] <... futex resumed>) = 0 [pid 297] mkdir("./18", 0777 [pid 830] <... mmap resumed>) = 0x7f0c41dcd000 [pid 829] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 828] <... write resumed>) = 262144 [pid 827] <... futex resumed>) = 1 [pid 826] close(3 [pid 824] <... write resumed>) = 4 [pid 823] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 822] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... mkdir resumed>) = 0 [pid 829] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 826] <... close resumed>) = 0 [pid 825] <... ioctl resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 821] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 829] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 826] mkdir("./bus", 0777 [pid 825] close(3 [pid 824] close(3 [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 821] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 829] <... mount resumed>) = 0 [pid 826] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 825] <... close resumed>) = 0 [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] ioctl(3, LOOP_CLR_FD [pid 829] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 826] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 825] mkdir("./bus", 0777 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 831] <... set_robust_list resumed>) = 0 [pid 830] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 829] <... futex resumed>) = 1 [pid 828] munmap(0x7f0c41dcd000, 138412032 [pid 827] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 825] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 824] <... close resumed>) = 0 [pid 823] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 822] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] close(3 [pid 829] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 825] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 822] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... close resumed>) = 0 [pid 829] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 828] <... munmap resumed>) = 0 [pid 827] <... mount resumed>) = 0 [pid 824] symlink("/dev/binderfs", "./binderfs" [pid 823] <... mprotect resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 829] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 828] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 827] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... symlink resumed>) = 0 [pid 823] rt_sigprocmask(SIG_BLOCK, ~[], [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 829] <... open resumed>) = 3 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 833 [pid 830] <... write resumed>) = 262144 [pid 829] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 828] <... openat resumed>) = 4 [pid 827] <... futex resumed>) = 1 [pid 823] <... rt_sigprocmask resumed>[], 8) = 0 [pid 821] <... futex resumed>) = 0 [pid 824] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 829] <... futex resumed>) = 1 [pid 822] <... futex resumed>) = 0 [pid 821] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 829] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 822] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] <... futex resumed>) = 0 [pid 829] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 822] <... futex resumed>) = 0 [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 831] rt_sigprocmask(SIG_SETMASK, [], [pid 830] munmap(0x7f0c41dcd000, 138412032 [pid 829] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 828] ioctl(4, LOOP_SET_FD, 3 [pid 827] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 824] <... futex resumed>) = 0 [pid 823] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 831] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 830] <... munmap resumed>) = 0 [pid 829] <... write resumed>) = 8 [pid 829] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 822] <... futex resumed>) = 0 [pid 829] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 822] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 829] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 822] <... futex resumed>) = 0 [pid 829] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 822] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 829] <... write resumed>) = 1045 [pid 829] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 822] <... futex resumed>) = 0 [pid 829] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 833 attached [pid 833] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 833] chdir("./18") = 0 [pid 833] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 833] setpgid(0, 0) = 0 [pid 833] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 833] write(3, "1000", 4) = 4 [pid 833] close(3) = 0 [pid 833] symlink("/dev/binderfs", "./binderfs") = 0 [pid 833] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 833] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 833] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 833] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 833] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 833] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[834]}, 88) = 834 [pid 833] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 833] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 833] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 827] <... open resumed>) = 3 [pid 824] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 833] <... mprotect resumed>) = 0 [pid 833] rt_sigprocmask(SIG_BLOCK, ~[], [pid 831] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 830] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 827] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... rt_sigaction resumed>NULL, 8) = 0 [pid 823] <... clone3 resumed> => {parent_tid=[835]}, 88) = 835 [pid 833] <... rt_sigprocmask resumed>[], 8) = 0 [pid 827] <... futex resumed>) = 1 [pid 824] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 823] rt_sigprocmask(SIG_SETMASK, [], [pid 821] <... futex resumed>) = 0 [pid 833] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 827] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 823] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 821] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 831] <... open resumed>) = 5 [pid 830] <... openat resumed>) = 4 [pid 827] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 824] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 823] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] <... futex resumed>) = 0 [pid 833] <... clone3 resumed> => {parent_tid=[837]}, 88) = 837 [pid 827] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 824] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 823] <... futex resumed>) = 0 [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 830] ioctl(4, LOOP_SET_FD, 3 [pid 833] rt_sigprocmask(SIG_SETMASK, [], [pid 831] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 827] <... write resumed>) = 8 [pid 824] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 823] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 833] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 833] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 837 attached [pid 837] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 837] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 837] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 837] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 833] <... futex resumed>) = 0 [pid 833] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 837] <... futex resumed>) = 1 [pid 837] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 837] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 833] <... futex resumed>) = 0 [pid 833] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 837] <... futex resumed>) = 1 [pid 837] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 837] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 833] <... futex resumed>) = 0 [pid 833] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 837] <... futex resumed>) = 1 [pid 837] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 837] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 833] <... futex resumed>) = 0 [pid 833] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 833] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 837] <... futex resumed>) = 1 [pid 837] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 837] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 833] <... futex resumed>) = 0 [pid 837] <... futex resumed>) = 1 [pid 837] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 834 attached [pid 834] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 834] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 834] memfd_create("syzkaller", 0) = 5 [pid 834] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 830] <... ioctl resumed>) = 0 [pid 824] <... mprotect resumed>) = 0 [pid 827] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 831] <... futex resumed>) = 1 [pid 820] <... futex resumed>) = 0 [pid 831] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 827] <... futex resumed>) = 1 [pid 824] rt_sigprocmask(SIG_BLOCK, ~[], [pid 821] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 834] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 831] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 827] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] <... rt_sigprocmask resumed>[], 8) = 0 [pid 821] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 831] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 830] close(3 [pid 828] <... ioctl resumed>) = 0 [pid 827] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 824] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 821] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 831] <... mount resumed>) = 0 [pid 828] close(3 [pid 827] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 821] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 831] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 828] <... close resumed>) = 0 [pid 827] <... write resumed>) = 1045 [pid 824] <... clone3 resumed> => {parent_tid=[839]}, 88) = 839 ./strace-static-x86_64: Process 835 attached [ 27.970965][ T826] loop5: detected capacity change from 0 to 512 [ 27.978050][ T825] loop0: detected capacity change from 0 to 512 [ 27.992814][ T828] loop1: detected capacity change from 0 to 512 [ 28.002070][ T830] loop4: detected capacity change from 0 to 512 [pid 834] <... write resumed>) = 262144 [pid 831] <... futex resumed>) = 1 [pid 830] <... close resumed>) = 0 [pid 828] mkdir("./bus", 0777 [pid 827] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] rt_sigprocmask(SIG_SETMASK, [], [pid 820] <... futex resumed>) = 0 [pid 828] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 831] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 827] <... futex resumed>) = 1 [pid 824] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 835] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 830] mkdir("./file1", 0777 [pid 821] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 834] munmap(0x7f0c41dcd000, 138412032 [pid 828] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 835] <... set_robust_list resumed>) = 0 [pid 834] <... munmap resumed>) = 0 [pid 831] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 830] <... mkdir resumed>) = 0 [pid 827] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 831] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 824] <... futex resumed>) = 0 [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 839 attached [pid 834] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 839] set_robust_list(0x7f0c4a20e9a0, 24 [pid 834] <... openat resumed>) = 6 [pid 839] <... set_robust_list resumed>) = 0 [ 28.013061][ T826] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 834] ioctl(6, LOOP_SET_FD, 5 [pid 839] rt_sigprocmask(SIG_SETMASK, [], [pid 835] rt_sigprocmask(SIG_SETMASK, [], [pid 831] <... open resumed>) = 3 [pid 830] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 839] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 839] memfd_create("syzkaller", 0) = 3 [pid 835] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 831] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 839] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 835] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 834] <... ioctl resumed>) = 0 [pid 831] <... futex resumed>) = 1 [pid 824] <... futex resumed>) = 0 [pid 823] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 820] <... futex resumed>) = 0 [pid 835] <... open resumed>) = 3 [pid 834] close(5 [pid 831] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 823] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 835] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 834] <... close resumed>) = 0 [pid 831] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 824] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 823] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 835] <... futex resumed>) = 0 [pid 834] mkdir("./file1", 0777 [pid 831] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 824] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 823] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 835] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 834] <... mkdir resumed>) = 0 [pid 824] <... mprotect resumed>) = 0 [pid 823] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 834] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 824] rt_sigprocmask(SIG_BLOCK, ~[], [pid 823] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 831] <... write resumed>) = 8 [pid 824] <... rt_sigprocmask resumed>[], 8) = 0 [pid 823] <... mprotect resumed>) = 0 [pid 831] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 823] rt_sigprocmask(SIG_BLOCK, ~[], [pid 831] <... futex resumed>) = 1 [pid 823] <... rt_sigprocmask resumed>[], 8) = 0 [pid 820] <... futex resumed>) = 0 [pid 831] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] <... clone3 resumed> => {parent_tid=[842]}, 88) = 842 [pid 823] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 820] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 831] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 824] rt_sigprocmask(SIG_SETMASK, [], [pid 820] <... futex resumed>) = 0 [pid 831] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 824] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 823] <... clone3 resumed> => {parent_tid=[843]}, 88) = 843 [pid 820] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 824] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 823] rt_sigprocmask(SIG_SETMASK, [], [pid 831] <... write resumed>) = 1045 [pid 831] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... futex resumed>) = 0 [pid 823] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 831] <... futex resumed>) = 1 [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 823] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 831] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 823] <... futex resumed>) = 0 [pid 823] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 839] <... mmap resumed>) = 0x7f0c41dcd000 [ 28.046356][ T834] loop3: detected capacity change from 0 to 512 [ 28.056710][ T825] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.070545][ T826] EXT4-fs (loop5): get root inode failed [ 28.077446][ T826] EXT4-fs (loop5): mount failed [pid 839] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 842 attached ) = 262144 ./strace-static-x86_64: Process 843 attached [pid 843] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 843] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 843] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 843] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 823] <... futex resumed>) = 0 [pid 823] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 835] <... futex resumed>) = 0 [pid 823] <... futex resumed>) = 1 [pid 835] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 823] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 835] <... open resumed>) = 5 [pid 835] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 823] <... futex resumed>) = 0 [pid 835] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 823] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 835] <... write resumed>) = 8 [pid 823] <... futex resumed>) = 0 [pid 835] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 823] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 835] <... futex resumed>) = 0 [pid 823] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 835] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 823] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 835] <... write resumed>) = 1045 [pid 823] <... futex resumed>) = 0 [pid 835] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 823] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 835] <... futex resumed>) = 0 [pid 823] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 835] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 843] <... futex resumed>) = 1 [pid 843] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 842] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 839] munmap(0x7f0c41dcd000, 138412032 [pid 842] <... set_robust_list resumed>) = 0 [pid 842] rt_sigprocmask(SIG_SETMASK, [], [pid 839] <... munmap resumed>) = 0 [pid 826] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 825] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 842] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 839] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 842] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 839] <... openat resumed>) = 4 [pid 826] ioctl(4, LOOP_CLR_FD [pid 825] ioctl(5, LOOP_CLR_FD [pid 826] <... ioctl resumed>) = 0 [pid 825] <... ioctl resumed>) = 0 [pid 842] <... open resumed>) = 5 [pid 839] ioctl(4, LOOP_SET_FD, 3 [pid 842] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 826] close(4 [pid 825] close(5 [pid 826] <... close resumed>) = 0 [pid 825] <... close resumed>) = 0 [pid 826] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 825] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 826] <... futex resumed>) = 0 [pid 825] <... futex resumed>) = 0 [pid 826] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 825] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 824] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 28.092243][ T825] EXT4-fs (loop0): get root inode failed [ 28.098676][ T825] EXT4-fs (loop0): mount failed [ 28.102438][ T828] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.114034][ T834] EXT4-fs (loop3): 1 orphan inode deleted [ 28.124713][ T839] loop2: detected capacity change from 0 to 512 [ 28.126104][ T834] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 842] <... futex resumed>) = 1 [pid 839] <... ioctl resumed>) = 0 [pid 824] <... futex resumed>) = 0 [pid 834] <... mount resumed>) = 0 [pid 834] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 834] chdir("./file1") = 0 [pid 834] ioctl(6, LOOP_CLR_FD) = 0 [pid 834] close(6) = 0 [pid 834] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 834] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 842] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 839] close(3 [pid 833] exit_group(0 [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=22000000} [pid 822] exit_group(0 [pid 821] exit_group(0 [pid 842] <... mount resumed>) = 0 [pid 834] <... futex resumed>) = ? [pid 833] <... exit_group resumed>) = ? [pid 822] <... exit_group resumed>) = ? [pid 837] <... futex resumed>) = ? [pid 834] +++ exited with 0 +++ [pid 829] <... futex resumed>) = ? [pid 827] <... futex resumed>) = ? [pid 825] <... futex resumed>) = ? [pid 821] <... exit_group resumed>) = ? [pid 827] +++ exited with 0 +++ [pid 829] +++ exited with 0 +++ [pid 826] <... futex resumed>) = ? [pid 825] +++ exited with 0 +++ [pid 826] +++ exited with 0 +++ [pid 842] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 839] <... close resumed>) = 0 [pid 837] +++ exited with 0 +++ [pid 833] +++ exited with 0 +++ [pid 842] <... futex resumed>) = 1 [pid 839] mkdir("./bus", 0777 [pid 824] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=833, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 842] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 839] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 824] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 842] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 839] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 824] <... futex resumed>) = 0 [pid 842] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 3 [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 842] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 842] <... futex resumed>) = 1 [pid 824] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 842] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 842] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 824] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 842] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 842] <... write resumed>) = 8 [pid 842] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 842] <... futex resumed>) = 1 [pid 824] <... futex resumed>) = 0 [pid 297] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 842] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 842] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 842] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 824] <... futex resumed>) = 0 [pid 824] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./18/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./18/bus") = 0 [pid 297] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./18/binderfs") = 0 [pid 297] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 842] <... write resumed>) = 1045 [pid 842] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 824] <... futex resumed>) = 0 [pid 842] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 828] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 830] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 828] ioctl(4, LOOP_CLR_FD) = 0 [pid 828] close(4) = 0 [pid 828] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 828] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 830] ioctl(4, LOOP_CLR_FD) = 0 [pid 830] close(4) = 0 [pid 830] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 830] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 823] exit_group(0 [pid 820] exit_group(0 [pid 823] <... exit_group resumed>) = ? [pid 820] <... exit_group resumed>) = ? [pid 828] <... futex resumed>) = ? [pid 828] +++ exited with 0 +++ [pid 830] <... futex resumed>) = ? [pid 830] +++ exited with 0 +++ [ 28.133961][ T830] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.144019][ T834] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/18/file1 supports timestamps until 2038 (0x7fffffff) [ 28.163420][ T828] EXT4-fs (loop1): get root inode failed [ 28.170293][ T830] EXT4-fs (loop4): get root inode failed [ 28.178434][ T830] EXT4-fs (loop4): mount failed [ 28.186766][ T828] EXT4-fs (loop1): mount failed [pid 831] <... futex resumed>) = ? [pid 835] <... futex resumed>) = ? [pid 835] +++ exited with 0 +++ [pid 843] <... futex resumed>) = ? [pid 839] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 839] ioctl(4, LOOP_CLR_FD) = 0 [pid 839] close(4) = 0 [pid 839] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 839] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 822] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=822, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 821] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=821, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 299] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 294] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 299] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./18/bus", [pid 294] newfstatat(AT_FDCWD, "./18/bus", [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./18/bus" [pid 294] unlink("./18/bus" [pid 824] exit_group(0 [pid 299] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./18/binderfs", [pid 294] newfstatat(AT_FDCWD, "./18/binderfs", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./18/binderfs" [pid 294] unlink("./18/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] getdents64(3, [pid 294] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 294] close(3 [pid 299] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 299] rmdir("./18" [pid 294] rmdir("./18" [pid 299] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 299] mkdir("./19", 0777 [pid 294] mkdir("./19", 0777 [pid 299] <... mkdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 294] close(3 [pid 299] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 851 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 852 ./strace-static-x86_64: Process 852 attached [pid 852] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 852] chdir("./19") = 0 [pid 852] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 852] setpgid(0, 0) = 0 [pid 852] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 852] write(3, "1000", 4 [pid 842] <... futex resumed>) = ? [pid 839] <... futex resumed>) = ? [pid 824] <... exit_group resumed>) = ? [pid 842] +++ exited with 0 +++ [pid 839] +++ exited with 0 +++ [pid 852] <... write resumed>) = 4 [pid 852] close(3) = 0 [pid 852] symlink("/dev/binderfs", "./binderfs") = 0 [pid 852] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 852] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 852] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 852] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 852] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 852] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 851 attached [], 8) = 0 [pid 852] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 851] set_robust_list(0x555556d8d6a0, 24) = 0 ./strace-static-x86_64: Process 853 attached [pid 852] <... clone3 resumed> => {parent_tid=[853]}, 88) = 853 [pid 851] chdir("./19" [pid 853] set_robust_list(0x7f0c4a20e9a0, 24 [pid 852] rt_sigprocmask(SIG_SETMASK, [], [pid 853] <... set_robust_list resumed>) = 0 [pid 852] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 853] rt_sigprocmask(SIG_SETMASK, [], [pid 852] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 853] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 852] <... futex resumed>) = 0 [pid 853] memfd_create("syzkaller", 0 [pid 852] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 851] <... chdir resumed>) = 0 [pid 853] <... memfd_create resumed>) = 3 [pid 852] <... futex resumed>) = 0 [pid 851] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 851] setpgid(0, 0) = 0 [pid 851] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 853] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 852] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 851] <... openat resumed>) = 3 [pid 851] write(3, "1000", 4) = 4 [pid 851] close(3) = 0 [pid 851] symlink("/dev/binderfs", "./binderfs" [pid 853] <... mmap resumed>) = 0x7f0c41dee000 [pid 852] <... mmap resumed>) = 0x7f0c41dcd000 [pid 851] <... symlink resumed>) = 0 [pid 851] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 851] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 851] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 851] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 852] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 851] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 852] <... mprotect resumed>) = 0 [pid 851] <... clone3 resumed> => {parent_tid=[854]}, 88) = 854 [pid 851] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 851] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 851] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 ./strace-static-x86_64: Process 854 attached [pid 853] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 852] rt_sigprocmask(SIG_BLOCK, ~[], [pid 851] rt_sigprocmask(SIG_BLOCK, ~[], [pid 843] +++ exited with 0 +++ [pid 831] +++ exited with 0 +++ [pid 823] +++ exited with 0 +++ [pid 820] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = 0 [pid 851] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 852] <... rt_sigprocmask resumed>[], 8) = 0 [pid 851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=823, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./18/file1", [pid 851] <... clone3 resumed> => {parent_tid=[855]}, 88) = 855 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 851] rt_sigprocmask(SIG_SETMASK, [], [pid 297] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=820, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- ./strace-static-x86_64: Process 855 attached [pid 854] set_robust_list(0x7f0c4a20e9a0, 24 [pid 853] <... write resumed>) = 262144 [pid 852] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 824] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 855] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 854] <... set_robust_list resumed>) = 0 [pid 853] munmap(0x7f0c41dee000, 138412032 [pid 851] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... restart_syscall resumed>) = 0 [pid 855] <... set_robust_list resumed>) = 0 [pid 854] rt_sigprocmask(SIG_SETMASK, [], [pid 853] <... munmap resumed>) = 0 [pid 852] <... clone3 resumed> => {parent_tid=[856]}, 88) = 856 [pid 851] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 4 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=824, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 855] rt_sigprocmask(SIG_SETMASK, [], [pid 854] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 853] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 852] rt_sigprocmask(SIG_SETMASK, [], [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] newfstatat(4, "", [pid 296] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 855] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 854] memfd_create("syzkaller", 0 [pid 853] <... openat resumed>) = 4 [pid 852] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 28.193986][ T839] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.207533][ T839] EXT4-fs (loop2): get root inode failed [ 28.213068][ T839] EXT4-fs (loop2): mount failed [pid 298] <... openat resumed>) = 3 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 856 attached [pid 855] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 854] <... memfd_create resumed>) = 3 [pid 853] ioctl(4, LOOP_SET_FD, 3 [pid 852] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(3, "", [pid 297] getdents64(4, [pid 296] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 856] set_robust_list(0x7f0c41ded9a0, 24 [pid 855] <... open resumed>) = 4 [pid 854] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 853] <... ioctl resumed>) = 0 [pid 852] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 856] <... set_robust_list resumed>) = 0 [pid 855] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 854] <... mmap resumed>) = 0x7f0c41dcd000 [pid 853] close(3 [pid 852] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] newfstatat(3, "", [pid 295] <... openat resumed>) = 3 [pid 856] rt_sigprocmask(SIG_SETMASK, [], [pid 855] <... futex resumed>) = 1 [pid 854] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 853] <... close resumed>) = 0 [pid 851] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] newfstatat(3, "", [pid 855] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 854] <... write resumed>) = 262144 [pid 853] mkdir("./file1", 0777 [pid 851] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, [pid 296] getdents64(3, [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 856] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 855] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 854] munmap(0x7f0c41dcd000, 138412032 [pid 853] <... mkdir resumed>) = 0 [pid 851] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] getdents64(3, [pid 856] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 855] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 854] <... munmap resumed>) = 0 [pid 853] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(4 [pid 296] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 856] <... open resumed>) = 3 [pid 855] <... mount resumed>) = 0 [pid 854] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 853] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 856] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 855] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 854] <... openat resumed>) = 5 [pid 853] ioctl(4, LOOP_CLR_FD [pid 298] newfstatat(AT_FDCWD, "./17/bus", [pid 297] rmdir("./18/file1" [pid 296] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 856] <... futex resumed>) = 1 [pid 855] <... futex resumed>) = 1 [pid 854] ioctl(5, LOOP_SET_FD, 3 [pid 853] <... ioctl resumed>) = 0 [pid 852] <... futex resumed>) = 0 [pid 851] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 856] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 855] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 854] <... ioctl resumed>) = 0 [pid 853] close(4 [pid 852] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 851] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./17/bus" [pid 297] <... rmdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./18/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 856] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 855] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 854] close(3 [pid 853] <... close resumed>) = 0 [pid 852] <... futex resumed>) = 0 [pid 851] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./17/bus", [pid 856] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 855] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 854] <... close resumed>) = 0 [pid 853] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 852] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] unlink("./18/bus" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 856] <... mount resumed>) = 0 [pid 855] <... open resumed>) = 3 [pid 854] mkdir("./bus", 0777 [pid 853] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] close(3 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./17/bus" [pid 856] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 855] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 854] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 853] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./17/binderfs", [pid 297] <... close resumed>) = 0 [pid 296] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 856] <... futex resumed>) = 1 [pid 855] <... futex resumed>) = 1 [pid 854] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 852] <... futex resumed>) = 0 [pid 851] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] rmdir("./18" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 856] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 855] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 852] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./17/binderfs" [pid 296] newfstatat(AT_FDCWD, "./18/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 853] <... futex resumed>) = 0 [pid 852] <... futex resumed>) = 1 [pid 851] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./17/binderfs", [pid 855] <... futex resumed>) = 0 [pid 853] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 852] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] <... futex resumed>) = 1 [pid 298] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] mkdir("./19", 0777 [pid 296] unlink("./18/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 855] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... mkdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./17/binderfs" [pid 855] <... write resumed>) = 8 [pid 298] newfstatat(AT_FDCWD, "./17/file1", [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 855] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 855] <... futex resumed>) = 1 [pid 851] <... futex resumed>) = 0 [pid 298] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] close(3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 855] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 851] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 855] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 851] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] close(3 [pid 296] rmdir("./18" [pid 295] <... close resumed>) = 0 [pid 855] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 851] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... openat resumed>) = 4 [pid 297] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] rmdir("./17" [pid 855] <... write resumed>) = 1045 [pid 298] newfstatat(4, "", [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] mkdir("./19", 0777 [pid 295] <... rmdir resumed>) = 0 [pid 855] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] mkdir("./18", 0777 [pid 855] <... futex resumed>) = 1 [pid 851] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 857 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... mkdir resumed>) = 0 [pid 855] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] getdents64(4, [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] close(4 [pid 296] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 298] rmdir("./17/file1" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] getdents64(3, [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 859 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 860 [pid 298] close(3) = 0 [pid 298] rmdir("./17") = 0 [pid 298] mkdir("./18", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 862 [pid 853] <... open resumed>) = 4 [pid 853] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 859 attached ) = 1 [pid 852] <... futex resumed>) = 0 [pid 859] set_robust_list(0x555556d8d6a0, 24 [pid 853] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 852] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... set_robust_list resumed>) = 0 [pid 853] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 852] <... futex resumed>) = 0 [pid 859] chdir("./19" [pid 853] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 852] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 860 attached ./strace-static-x86_64: Process 857 attached [pid 859] <... chdir resumed>) = 0 [pid 853] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 859] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 853] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... prctl resumed>) = 0 [pid 853] <... futex resumed>) = 1 [pid 852] <... futex resumed>) = 0 ./strace-static-x86_64: Process 862 attached [pid 860] set_robust_list(0x555556d8d6a0, 24 [pid 859] setpgid(0, 0 [pid 857] set_robust_list(0x555556d8d6a0, 24 [pid 853] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 852] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... setpgid resumed>) = 0 [pid 853] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 852] <... futex resumed>) = 0 [pid 860] <... set_robust_list resumed>) = 0 [pid 862] set_robust_list(0x555556d8d6a0, 24 [pid 859] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 857] <... set_robust_list resumed>) = 0 [ 28.259740][ T853] loop0: detected capacity change from 0 to 512 [ 28.279787][ T854] loop5: detected capacity change from 0 to 512 [pid 853] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 852] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 862] <... set_robust_list resumed>) = 0 [pid 860] chdir("./18" [pid 859] <... openat resumed>) = 3 [pid 857] chdir("./19" [pid 853] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 862] chdir("./18" [pid 860] <... chdir resumed>) = 0 [pid 857] <... chdir resumed>) = 0 [pid 862] <... chdir resumed>) = 0 [pid 860] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 857] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 862] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 860] <... prctl resumed>) = 0 [pid 857] <... prctl resumed>) = 0 [pid 862] <... prctl resumed>) = 0 [pid 860] setpgid(0, 0 [pid 857] setpgid(0, 0 [pid 862] setpgid(0, 0 [pid 860] <... setpgid resumed>) = 0 [pid 857] <... setpgid resumed>) = 0 [pid 862] <... setpgid resumed>) = 0 [pid 860] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 857] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 860] <... openat resumed>) = 3 [pid 857] <... openat resumed>) = 3 [pid 862] <... openat resumed>) = 3 [pid 860] write(3, "1000", 4 [pid 857] write(3, "1000", 4 [pid 862] write(3, "1000", 4 [pid 860] <... write resumed>) = 4 [pid 857] <... write resumed>) = 4 [pid 862] <... write resumed>) = 4 [pid 860] close(3 [pid 857] close(3 [pid 862] close(3 [pid 860] <... close resumed>) = 0 [pid 857] <... close resumed>) = 0 [pid 862] <... close resumed>) = 0 [pid 860] symlink("/dev/binderfs", "./binderfs" [pid 857] symlink("/dev/binderfs", "./binderfs" [pid 862] symlink("/dev/binderfs", "./binderfs" [pid 860] <... symlink resumed>) = 0 [pid 857] <... symlink resumed>) = 0 [pid 862] <... symlink resumed>) = 0 [pid 860] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 860] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 860] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 857] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 862] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 860] <... rt_sigaction resumed>NULL, 8) = 0 [pid 857] <... rt_sigaction resumed>NULL, 8) = 0 [pid 862] <... rt_sigaction resumed>NULL, 8) = 0 [pid 860] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 857] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 862] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 857] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 862] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 860] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 857] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 862] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 860] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 857] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 862] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 860] <... mprotect resumed>) = 0 [pid 857] <... mprotect resumed>) = 0 [pid 862] <... mprotect resumed>) = 0 [pid 860] rt_sigprocmask(SIG_BLOCK, ~[], [pid 859] write(3, "1000", 4 [pid 857] rt_sigprocmask(SIG_BLOCK, ~[], [pid 853] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] rt_sigprocmask(SIG_BLOCK, ~[], [pid 860] <... rt_sigprocmask resumed>[], 8) = 0 [pid 857] <... rt_sigprocmask resumed>[], 8) = 0 [pid 853] <... futex resumed>) = 1 [pid 852] <... futex resumed>) = 0 [pid 859] <... write resumed>) = 4 [pid 862] <... rt_sigprocmask resumed>[], 8) = 0 [pid 860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 859] close(3 [pid 857] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 853] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 852] exit_group(0 [pid 862] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 859] <... close resumed>) = 0 [pid 856] <... futex resumed>) = ? [pid 853] <... futex resumed>) = ? [pid 852] <... exit_group resumed>) = ? [pid 860] <... clone3 resumed> => {parent_tid=[863]}, 88) = 863 [pid 859] symlink("/dev/binderfs", "./binderfs" [pid 857] <... clone3 resumed> => {parent_tid=[864]}, 88) = 864 [pid 856] +++ exited with 0 +++ [pid 862] <... clone3 resumed> => {parent_tid=[865]}, 88) = 865 [pid 860] rt_sigprocmask(SIG_SETMASK, [], [pid 857] rt_sigprocmask(SIG_SETMASK, [], [pid 862] rt_sigprocmask(SIG_SETMASK, [], [pid 860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 860] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 860] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 860] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 857] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 862] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 860] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 857] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 862] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 860] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 857] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 862] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 860] <... mprotect resumed>) = 0 [pid 857] <... mprotect resumed>) = 0 [pid 862] <... mprotect resumed>) = 0 [pid 860] rt_sigprocmask(SIG_BLOCK, ~[], [pid 857] rt_sigprocmask(SIG_BLOCK, ~[], [pid 862] rt_sigprocmask(SIG_BLOCK, ~[], [pid 860] <... rt_sigprocmask resumed>[], 8) = 0 [pid 857] <... rt_sigprocmask resumed>[], 8) = 0 [pid 862] <... rt_sigprocmask resumed>[], 8) = 0 [pid 860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 857] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 862] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 860] <... clone3 resumed> => {parent_tid=[866]}, 88) = 866 [pid 857] <... clone3 resumed> => {parent_tid=[867]}, 88) = 867 [pid 862] <... clone3 resumed> => {parent_tid=[868]}, 88) = 868 [pid 860] rt_sigprocmask(SIG_SETMASK, [], [pid 857] rt_sigprocmask(SIG_SETMASK, [], [pid 862] rt_sigprocmask(SIG_SETMASK, [], [pid 860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 860] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 860] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 865 attached [pid 865] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 865] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 865] memfd_create("syzkaller", 0) = 3 [pid 865] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 868 attached [pid 868] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 868] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 868] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 ./strace-static-x86_64: Process 863 attached ./strace-static-x86_64: Process 867 attached [pid 863] set_robust_list(0x7f0c4a20e9a0, 24 [pid 867] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 863] <... set_robust_list resumed>) = 0 [pid 867] <... set_robust_list resumed>) = 0 [pid 863] rt_sigprocmask(SIG_SETMASK, [], [pid 867] rt_sigprocmask(SIG_SETMASK, [], [pid 853] +++ exited with 0 +++ ./strace-static-x86_64: Process 864 attached [pid 867] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 863] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 859] <... symlink resumed>) = 0 [pid 852] +++ exited with 0 +++ [pid 868] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 867] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 864] set_robust_list(0x7f0c4a20e9a0, 24 [pid 863] memfd_create("syzkaller", 0 [pid 859] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=852, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- ./strace-static-x86_64: Process 866 attached [pid 868] <... futex resumed>) = 1 [pid 867] <... open resumed>) = 3 [pid 865] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 864] <... set_robust_list resumed>) = 0 [pid 863] <... memfd_create resumed>) = 3 [pid 862] <... futex resumed>) = 0 [pid 859] <... futex resumed>) = 0 [pid 854] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 868] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 867] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 866] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 864] rt_sigprocmask(SIG_SETMASK, [], [pid 863] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 862] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 854] ioctl(5, LOOP_CLR_FD [pid 868] <... mount resumed>) = 0 [pid 867] <... futex resumed>) = 1 [pid 866] <... set_robust_list resumed>) = 0 [pid 865] <... write resumed>) = 262144 [pid 863] <... mmap resumed>) = 0x7f0c41dcd000 [pid 862] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 867] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 864] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] <... rt_sigaction resumed>NULL, 8) = 0 [pid 857] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 854] <... ioctl resumed>) = 0 [pid 294] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 868] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 867] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 866] rt_sigprocmask(SIG_SETMASK, [], [pid 865] munmap(0x7f0c41dcd000, 138412032 [pid 864] memfd_create("syzkaller", 0 [pid 863] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 862] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 859] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 857] <... futex resumed>) = 0 [pid 854] close(5 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 868] <... futex resumed>) = 0 [pid 867] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 866] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 864] <... memfd_create resumed>) = 4 [pid 862] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 854] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 867] <... mount resumed>) = 0 [pid 864] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 862] <... futex resumed>) = 0 [pid 859] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 854] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... openat resumed>) = 3 [pid 867] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 864] <... mmap resumed>) = 0x7f0c41dcd000 [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 854] <... futex resumed>) = 0 [pid 294] newfstatat(3, "", [pid 868] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 867] <... futex resumed>) = 1 [pid 866] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 865] <... munmap resumed>) = 0 [pid 864] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 863] <... write resumed>) = 262144 [pid 857] <... futex resumed>) = 0 [pid 868] <... open resumed>) = 5 [pid 868] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 866] <... open resumed>) = 4 [pid 865] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 863] munmap(0x7f0c41dcd000, 138412032 [pid 868] <... futex resumed>) = 1 [pid 862] <... futex resumed>) = 0 [pid 868] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 866] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] <... openat resumed>) = 6 [pid 863] <... munmap resumed>) = 0 [pid 862] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 868] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 866] <... futex resumed>) = 1 [pid 865] ioctl(6, LOOP_SET_FD, 3 [pid 863] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 862] <... futex resumed>) = 0 [pid 860] <... futex resumed>) = 0 [pid 868] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 867] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 866] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 864] <... write resumed>) = 262144 [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 857] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 854] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 851] exit_group(0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 867] <... open resumed>) = 5 [pid 864] munmap(0x7f0c41dcd000, 138412032 [pid 859] <... mprotect resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 855] <... futex resumed>) = ? [pid 854] <... futex resumed>) = ? [pid 851] <... exit_group resumed>) = ? [pid 294] getdents64(3, [pid 867] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 864] <... munmap resumed>) = 0 [pid 860] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] rt_sigprocmask(SIG_BLOCK, ~[], [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 855] +++ exited with 0 +++ [pid 854] +++ exited with 0 +++ [ 28.324903][ T854] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.340657][ T854] EXT4-fs (loop5): get root inode failed [ 28.347866][ T854] EXT4-fs (loop5): mount failed [ 28.367758][ T865] loop4: detected capacity change from 0 to 512 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 867] <... futex resumed>) = 0 [pid 864] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 859] <... rt_sigprocmask resumed>[], 8) = 0 [pid 857] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 867] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 864] <... openat resumed>) = 6 [pid 859] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 857] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 867] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 864] ioctl(6, LOOP_SET_FD, 4 [pid 857] <... futex resumed>) = 0 ./strace-static-x86_64: Process 869 attached [pid 868] <... write resumed>) = -1 EIO (Input/output error) [pid 867] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 866] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 865] <... ioctl resumed>) = 0 [pid 863] <... openat resumed>) = 5 [pid 860] <... futex resumed>) = 0 [pid 869] set_robust_list(0x7f0c4a20e9a0, 24 [pid 868] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 866] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 865] close(3 [pid 863] ioctl(5, LOOP_SET_FD, 3 [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 869] <... set_robust_list resumed>) = 0 [pid 868] <... futex resumed>) = 1 [pid 866] <... mount resumed>) = 0 [pid 865] <... close resumed>) = 0 [pid 864] <... ioctl resumed>) = 0 [pid 863] <... ioctl resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 859] <... clone3 resumed> => {parent_tid=[869]}, 88) = 869 [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] +++ exited with 0 +++ [pid 869] rt_sigprocmask(SIG_SETMASK, [], [pid 868] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 866] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] mkdir("./bus", 0777 [pid 864] close(4 [pid 863] close(3 [pid 862] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 869] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 868] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 866] <... futex resumed>) = 1 [pid 865] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 864] <... close resumed>) = 0 [pid 863] <... close resumed>) = 0 [pid 862] <... futex resumed>) = 0 [pid 860] <... futex resumed>) = 0 [pid 869] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 868] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 866] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 865] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 864] mkdir("./file1", 0777 [pid 863] mkdir("./bus", 0777 [pid 862] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 860] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 868] <... write resumed>) = 1045 [pid 867] <... write resumed>) = -1 EIO (Input/output error) [pid 866] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 863] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 860] <... futex resumed>) = 0 [pid 859] rt_sigprocmask(SIG_SETMASK, [], [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=851, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] <... umount2 resumed>) = 0 [pid 868] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 867] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 866] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 863] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 868] <... futex resumed>) = 1 [pid 867] <... futex resumed>) = 1 [pid 866] <... open resumed>) = 3 [pid 862] <... futex resumed>) = 0 [pid 859] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 869] <... futex resumed>) = 0 [pid 868] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 866] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... futex resumed>) = 1 [pid 857] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./19/bus", [pid 869] memfd_create("syzkaller", 0 [pid 867] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 866] <... futex resumed>) = 1 [pid 860] <... futex resumed>) = 0 [pid 859] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 857] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 869] <... memfd_create resumed>) = 3 [pid 866] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 860] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... futex resumed>) = 0 [pid 857] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] unlink("./19/bus" [pid 869] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 867] <... write resumed>) = 1045 [pid 866] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 860] <... futex resumed>) = 0 [pid 859] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... openat resumed>) = 3 [pid 294] <... unlink resumed>) = 0 [pid 869] <... mmap resumed>) = 0x7f0c41dee000 [pid 867] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 866] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] <... mmap resumed>) = 0x7f0c41dcd000 [pid 299] newfstatat(3, "", [pid 294] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 859] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 859] <... mprotect resumed>) = 0 [pid 299] getdents64(3, [pid 294] newfstatat(AT_FDCWD, "./19/binderfs", [pid 866] <... write resumed>) = 8 [pid 859] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 859] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] unlink("./19/binderfs" [pid 866] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 299] <... umount2 resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 869] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 867] <... futex resumed>) = 1 [pid 866] <... futex resumed>) = 1 [pid 860] <... futex resumed>) = 0 [pid 857] <... futex resumed>) = 0 [pid 299] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 866] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 860] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] <... clone3 resumed> => {parent_tid=[870]}, 88) = 870 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 859] rt_sigprocmask(SIG_SETMASK, [], [pid 299] newfstatat(AT_FDCWD, "./19/bus", [pid 294] newfstatat(AT_FDCWD, "./19/file1", [pid 859] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 859] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./19/bus" [pid 294] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 859] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 859] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... openat resumed>) = 4 [pid 299] newfstatat(AT_FDCWD, "./19/binderfs", [pid 294] newfstatat(4, "", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] unlink("./19/binderfs" [pid 294] getdents64(4, [pid 299] <... unlink resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(3, [pid 294] getdents64(4, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 294] close(4 [pid 299] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 299] rmdir("./19" [pid 294] rmdir("./19/file1" [pid 299] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 299] mkdir("./20", 0777 [pid 294] getdents64(3, [pid 299] <... mkdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 294] close(3 [pid 299] <... openat resumed>) = 3 [pid 294] <... close resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 294] rmdir("./19" [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... rmdir resumed>) = 0 [pid 299] close(3 [pid 294] mkdir("./20", 0777 [pid 299] <... close resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 871 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 872 ./strace-static-x86_64: Process 871 attached [pid 871] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 871] chdir("./20") = 0 [pid 871] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 871] setpgid(0, 0) = 0 [pid 871] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 866] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 860] <... futex resumed>) = 0 [pid 871] write(3, "1000", 4 [pid 860] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 866] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 871] <... write resumed>) = 4 [pid 871] close(3) = 0 [pid 871] symlink("/dev/binderfs", "./binderfs") = 0 [pid 869] <... write resumed>) = 262144 [pid 867] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 866] <... write resumed>) = 1045 [pid 871] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 869] munmap(0x7f0c41dee000, 138412032 [pid 866] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 866] <... futex resumed>) = 1 [pid 860] <... futex resumed>) = 0 [pid 866] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 871] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 871] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 871] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 871] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 871] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ./strace-static-x86_64: Process 872 attached [pid 871] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 872] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 871] <... clone3 resumed> => {parent_tid=[874]}, 88) = 874 [pid 872] chdir("./20" [pid 871] rt_sigprocmask(SIG_SETMASK, [], [pid 872] <... chdir resumed>) = 0 [pid 871] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 872] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 871] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 872] <... prctl resumed>) = 0 [pid 871] <... futex resumed>) = 0 [pid 872] setpgid(0, 0 [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 872] <... setpgid resumed>) = 0 [pid 871] <... futex resumed>) = 0 [pid 872] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 871] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 872] <... openat resumed>) = 3 [pid 871] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 872] write(3, "1000", 4 [pid 871] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 872] <... write resumed>) = 4 [pid 871] <... mprotect resumed>) = 0 [pid 872] close(3 [pid 871] rt_sigprocmask(SIG_BLOCK, ~[], [pid 872] <... close resumed>) = 0 [pid 871] <... rt_sigprocmask resumed>[], 8) = 0 [pid 869] <... munmap resumed>) = 0 [pid 872] symlink("/dev/binderfs", "./binderfs" [pid 871] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 872] <... symlink resumed>) = 0 [pid 869] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 864] <... mkdir resumed>) = 0 [pid 872] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... clone3 resumed> => {parent_tid=[875]}, 88) = 875 [pid 869] <... openat resumed>) = 4 [ 28.374727][ T54] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.377864][ T864] loop3: detected capacity change from 0 to 512 [ 28.386803][ T863] loop1: detected capacity change from 0 to 512 [ 28.393398][ T43] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.413653][ T865] EXT4-fs (loop4): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [pid 872] <... futex resumed>) = 0 [pid 871] rt_sigprocmask(SIG_SETMASK, [], [pid 869] ioctl(4, LOOP_SET_FD, 3 [pid 872] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 871] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 872] <... rt_sigaction resumed>NULL, 8) = 0 [pid 871] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 872] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 871] <... futex resumed>) = 0 [pid 872] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 872] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 872] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[876]}, 88) = 876 [pid 872] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 872] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 872] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 872] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[877]}, 88) = 877 [pid 872] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 872] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 875 attached ./strace-static-x86_64: Process 874 attached [pid 875] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 874] set_robust_list(0x7f0c4a20e9a0, 24 [pid 875] <... set_robust_list resumed>) = 0 [pid 874] <... set_robust_list resumed>) = 0 [pid 875] rt_sigprocmask(SIG_SETMASK, [], [pid 874] rt_sigprocmask(SIG_SETMASK, [], [pid 875] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 874] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 875] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 874] memfd_create("syzkaller", 0 [pid 875] <... open resumed>) = 3 [pid 874] <... memfd_create resumed>) = 4 [pid 875] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 874] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 875] <... futex resumed>) = 1 [pid 874] <... mmap resumed>) = 0x7f0c41dcd000 [pid 871] <... futex resumed>) = 0 [pid 875] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 874] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 871] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 875] <... mount resumed>) = 0 [pid 871] <... futex resumed>) = 0 ./strace-static-x86_64: Process 876 attached [pid 875] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 876] set_robust_list(0x7f0c4a20e9a0, 24 [pid 875] <... futex resumed>) = 0 [pid 874] <... write resumed>) = 262144 [pid 871] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 864] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 876] <... set_robust_list resumed>) = 0 [pid 875] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 871] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 876] rt_sigprocmask(SIG_SETMASK, [], [pid 875] <... open resumed>) = 5 [pid 871] <... futex resumed>) = 0 [pid 876] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 875] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 876] memfd_create("syzkaller", 0 [pid 875] <... futex resumed>) = 0 [pid 871] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 876] <... memfd_create resumed>) = 3 [pid 875] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 874] munmap(0x7f0c41dcd000, 138412032 [pid 871] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 876] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 875] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 871] <... futex resumed>) = 0 [pid 874] <... munmap resumed>) = 0 [pid 876] <... mmap resumed>) = 0x7f0c41dcd000 [pid 875] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 874] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 876] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 875] <... futex resumed>) = 0 [pid 874] <... openat resumed>) = 6 [pid 871] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 876] <... write resumed>) = 262144 [pid 875] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 874] ioctl(6, LOOP_SET_FD, 4 [pid 871] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 875] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 871] <... futex resumed>) = 0 [pid 875] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 871] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 877 attached ./strace-static-x86_64: Process 870 attached [pid 876] munmap(0x7f0c41dcd000, 138412032 [pid 874] <... ioctl resumed>) = 0 [pid 869] <... ioctl resumed>) = 0 [pid 877] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 876] <... munmap resumed>) = 0 [pid 874] close(4 [pid 870] set_robust_list(0x7f0c41ded9a0, 24 [pid 869] close(3 [pid 877] <... set_robust_list resumed>) = 0 [pid 876] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 874] <... close resumed>) = 0 [pid 870] <... set_robust_list resumed>) = 0 [pid 869] <... close resumed>) = 0 [pid 877] rt_sigprocmask(SIG_SETMASK, [], [pid 876] <... openat resumed>) = 4 [pid 874] mkdir("./bus", 0777 [pid 870] rt_sigprocmask(SIG_SETMASK, [], [pid 869] mkdir("./file1", 0777 [pid 877] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 876] ioctl(4, LOOP_SET_FD, 3 [pid 874] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 870] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 869] <... mkdir resumed>) = 0 [pid 877] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 875] <... write resumed>) = -1 EIO (Input/output error) [pid 859] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 875] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 875] <... futex resumed>) = 1 [pid 871] <... futex resumed>) = 0 [pid 859] <... futex resumed>) = 0 [pid 875] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 859] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 859] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 859] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 859] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[880]}, 88) = 880 [pid 859] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 859] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 859] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 877] <... open resumed>) = 5 [pid 874] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 870] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 869] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 865] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 864] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 877] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 872] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 870] <... open resumed>) = 3 [pid 865] ioctl(6, LOOP_CLR_FD [pid 864] ioctl(6, LOOP_CLR_FD [pid 877] <... futex resumed>) = 0 [pid 872] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] <... ioctl resumed>) = 0 [pid 864] <... ioctl resumed>) = 0 [pid 877] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 872] <... futex resumed>) = 0 [pid 870] <... futex resumed>) = 0 [ 28.431213][ T869] loop2: detected capacity change from 0 to 512 [ 28.440415][ T864] EXT4-fs (loop3): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [ 28.443834][ T874] loop5: detected capacity change from 0 to 512 [ 28.456892][ T43] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.466029][ T876] loop0: detected capacity change from 0 to 512 [pid 865] close(6 [pid 864] close(6./strace-static-x86_64: Process 880 attached [pid 877] <... mount resumed>) = 0 [pid 876] <... ioctl resumed>) = 0 [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 870] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 865] <... close resumed>) = 0 [pid 864] <... close resumed>) = 0 [pid 859] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 880] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 877] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 876] close(3 [pid 872] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 865] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 864] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 859] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 880] <... set_robust_list resumed>) = 0 [pid 877] <... futex resumed>) = 0 [pid 876] <... close resumed>) = 0 [pid 872] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] <... futex resumed>) = 0 [pid 865] <... futex resumed>) = 0 [pid 864] <... futex resumed>) = 0 [pid 859] <... futex resumed>) = 1 [pid 880] rt_sigprocmask(SIG_SETMASK, [], [pid 877] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 876] mkdir("./bus", 0777 [pid 872] <... futex resumed>) = 0 [pid 870] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 865] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 864] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 859] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 877] <... open resumed>) = 3 [pid 876] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 870] <... open resumed>) = 5 [pid 880] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 877] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 876] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 872] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 870] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 862] exit_group(0 [pid 857] exit_group(0 [pid 880] <... mount resumed>) = 0 [pid 877] <... futex resumed>) = 0 [pid 872] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] <... futex resumed>) = 1 [pid 868] <... futex resumed>) = ? [pid 867] <... futex resumed>) = ? [pid 865] <... futex resumed>) = ? [pid 864] <... futex resumed>) = ? [pid 862] <... exit_group resumed>) = ? [pid 859] <... futex resumed>) = 0 [pid 857] <... exit_group resumed>) = ? [pid 880] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 877] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 872] <... futex resumed>) = 0 [pid 870] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 868] +++ exited with 0 +++ [pid 859] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 880] <... futex resumed>) = 0 [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 870] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 867] +++ exited with 0 +++ [pid 859] <... futex resumed>) = 0 [pid 880] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 870] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [ 28.498060][ T863] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 859] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 877] <... write resumed>) = 8 [pid 877] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 877] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 872] <... futex resumed>) = 0 [ 28.546577][ T874] EXT4-fs (loop5): 1 orphan inode deleted [ 28.552338][ T863] EXT4-fs (loop1): get root inode failed [ 28.553354][ T874] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 28.557909][ T863] EXT4-fs (loop1): mount failed [ 28.574392][ T874] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/20/bus supports timestamps until 2038 (0x7fffffff) [ 28.576067][ T869] EXT4-fs (loop2): 1 orphan inode deleted [pid 872] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] +++ exited with 0 +++ [pid 864] +++ exited with 0 +++ [pid 863] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 862] +++ exited with 0 +++ [pid 859] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 857] +++ exited with 0 +++ [pid 877] <... futex resumed>) = 0 [pid 872] <... futex resumed>) = 1 [pid 863] ioctl(5, LOOP_CLR_FD [pid 859] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=862, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=857, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 880] <... futex resumed>) = 0 [pid 877] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 874] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 872] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 870] <... write resumed>) = 8 [pid 863] <... ioctl resumed>) = 0 [pid 859] <... futex resumed>) = 1 [pid 880] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 877] <... write resumed>) = 1045 [pid 874] ioctl(6, LOOP_CLR_FD [pid 870] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 863] close(5 [pid 859] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 877] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 874] <... ioctl resumed>) = 0 [pid 870] <... futex resumed>) = 0 [pid 863] <... close resumed>) = 0 [pid 877] <... futex resumed>) = 1 [pid 874] close(6 [pid 872] <... futex resumed>) = 0 [pid 870] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 863] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 877] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 874] <... close resumed>) = 0 [pid 863] <... futex resumed>) = 0 [pid 298] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 880] <... write resumed>) = 1045 [pid 874] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 863] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 880] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 874] <... futex resumed>) = 0 [pid 871] exit_group(0 [pid 298] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 880] <... futex resumed>) = 1 [pid 875] <... futex resumed>) = ? [pid 871] <... exit_group resumed>) = ? [pid 859] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 880] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 875] +++ exited with 0 +++ [pid 874] +++ exited with 0 +++ [pid 298] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 860] exit_group(0 [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 866] <... futex resumed>) = ? [pid 863] <... futex resumed>) = ? [pid 860] <... exit_group resumed>) = ? [pid 866] +++ exited with 0 +++ [pid 863] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 869] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 869] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./19/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./19/bus" [pid 298] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... unlink resumed>) = 0 [ 28.592908][ T869] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 28.604031][ T869] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/19/bus supports timestamps until 2038 (0x7fffffff) [ 28.632272][ T876] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./18/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./18/bus") = 0 [pid 298] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./18/binderfs") = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 297] newfstatat(AT_FDCWD, "./19/binderfs", [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./18") = 0 [pid 298] mkdir("./19", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./19/binderfs" [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... unlink resumed>) = 0 [pid 876] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 876] ioctl(4, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 876] <... ioctl resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./19/file1", [pid 876] close(4 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 876] <... close resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 887 [pid 297] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 876] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 876] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 876] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... openat resumed>) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./19/file1" [pid 860] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 872] exit_group(0 [pid 297] getdents64(3, [pid 877] <... futex resumed>) = ? [pid 876] <... futex resumed>) = ? [pid 872] <... exit_group resumed>) = ? [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 877] +++ exited with 0 +++ [pid 869] <... ioctl resumed>) = 0 [pid 297] close(3 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=860, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./19") = 0 [pid 297] mkdir("./20", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 887 attached [pid 869] close(4 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 888 ./strace-static-x86_64: Process 888 attached [pid 888] set_robust_list(0x555556d8d6a0, 24 [pid 869] <... close resumed>) = 0 [pid 888] <... set_robust_list resumed>) = 0 [pid 888] chdir("./20" [pid 869] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 888] <... chdir resumed>) = 0 [pid 869] <... futex resumed>) = 0 [pid 888] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 888] setpgid(0, 0) = 0 [pid 888] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 869] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 888] <... openat resumed>) = 3 [pid 887] set_robust_list(0x555556d8d6a0, 24 [pid 888] write(3, "1000", 4 [pid 871] +++ exited with 0 +++ [pid 859] exit_group(0 [pid 295] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] <... write resumed>) = 4 [pid 880] <... futex resumed>) = ? [pid 870] <... futex resumed>) = ? [pid 869] <... futex resumed>) = ? [pid 859] <... exit_group resumed>) = ? [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=871, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 888] close(3 [pid 880] +++ exited with 0 +++ [pid 870] +++ exited with 0 +++ [pid 869] +++ exited with 0 +++ [pid 859] +++ exited with 0 +++ [pid 295] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 888] <... close resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=859, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] <... openat resumed>) = 3 [pid 888] symlink("/dev/binderfs", "./binderfs" [pid 299] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(3, "", [pid 888] <... symlink resumed>) = 0 [pid 887] <... set_robust_list resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 888] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 888] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 888] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 299] newfstatat(3, "", [pid 296] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = 0 [pid 888] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] getdents64(3, [pid 296] newfstatat(3, "", [pid 295] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 295] newfstatat(AT_FDCWD, "./18/bus", [pid 888] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 887] chdir("./19" [pid 299] <... umount2 resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 888] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 887] <... chdir resumed>) = 0 [pid 299] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./18/bus" [pid 888] <... mprotect resumed>) = 0 [pid 887] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 888] rt_sigprocmask(SIG_BLOCK, ~[], [pid 887] <... prctl resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./20/bus", [pid 296] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 887] setpgid(0, 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] unlink("./20/bus" [pid 296] newfstatat(AT_FDCWD, "./19/bus", [pid 295] newfstatat(AT_FDCWD, "./18/binderfs", [pid 887] <... setpgid resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 888] <... clone3 resumed> => {parent_tid=[889]}, 88) = 889 [pid 299] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./19/bus" [pid 295] unlink("./18/binderfs" [pid 888] rt_sigprocmask(SIG_SETMASK, [], [pid 887] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 887] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./20/binderfs", [pid 296] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 888] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] write(3, "1000", 4 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 888] <... futex resumed>) = 0 [pid 299] unlink("./20/binderfs" [pid 296] newfstatat(AT_FDCWD, "./19/binderfs", [pid 295] close(3 [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] <... write resumed>) = 4 [pid 299] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... close resumed>) = 0 ./strace-static-x86_64: Process 889 attached [pid 888] <... futex resumed>) = 0 [pid 887] close(3 [pid 299] getdents64(3, [pid 296] unlink("./19/binderfs" [pid 295] rmdir("./18" [pid 888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 888] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] close(3 [pid 296] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] mkdir("./19", 0777 [pid 888] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... mkdir resumed>) = 0 [pid 888] <... mprotect resumed>) = 0 [pid 299] rmdir("./20" [pid 296] newfstatat(AT_FDCWD, "./19/file1", [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 888] rt_sigprocmask(SIG_BLOCK, ~[], [pid 887] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... openat resumed>) = 3 [pid 888] <... rt_sigprocmask resumed>[], 8) = 0 [pid 887] symlink("/dev/binderfs", "./binderfs" [pid 876] +++ exited with 0 +++ [pid 872] +++ exited with 0 +++ [pid 299] mkdir("./21", 0777 [pid 296] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] ioctl(3, LOOP_CLR_FD [pid 888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 887] <... symlink resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=872, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 887] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] close(3 [pid 888] <... clone3 resumed> => {parent_tid=[890]}, 88) = 890 [pid 887] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 4 [pid 295] <... close resumed>) = 0 [pid 888] rt_sigprocmask(SIG_SETMASK, [], [pid 887] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] newfstatat(4, "", [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 887] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] close(3 [pid 296] getdents64(4, [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 891 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 890 attached [pid 889] set_robust_list(0x7f0c4a20e9a0, 24 [pid 888] <... futex resumed>) = 0 [pid 887] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 889] <... set_robust_list resumed>) = 0 [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] getdents64(4, [pid 294] <... openat resumed>) = 3 [pid 890] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 889] rt_sigprocmask(SIG_SETMASK, [], [pid 887] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] newfstatat(3, "", [pid 890] <... set_robust_list resumed>) = 0 [pid 889] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 887] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 892 [pid 296] close(4 [pid 890] rt_sigprocmask(SIG_SETMASK, [], [pid 889] memfd_create("syzkaller", 0 [pid 887] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 890] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 889] <... memfd_create resumed>) = 3 [pid 887] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] rmdir("./19/file1" [pid 294] getdents64(3, [pid 890] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 889] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 887] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 889] <... mmap resumed>) = 0x7f0c41dcd000 [pid 887] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] getdents64(3, [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 890] <... open resumed>) = 4 [pid 889] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 892 attached [pid 890] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] <... write resumed>) = 262144 [pid 887] <... clone3 resumed> => {parent_tid=[893]}, 88) = 893 [pid 296] close(3./strace-static-x86_64: Process 891 attached [pid 892] set_robust_list(0x555556d8d6a0, 24 [pid 889] munmap(0x7f0c41dcd000, 138412032 [pid 296] <... close resumed>) = 0 [pid 892] <... set_robust_list resumed>) = 0 [pid 891] set_robust_list(0x555556d8d6a0, 24 [pid 889] <... munmap resumed>) = 0 [pid 296] rmdir("./19" [pid 892] chdir("./21" [pid 891] <... set_robust_list resumed>) = 0 [pid 889] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 887] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... rmdir resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 893 attached [pid 892] <... chdir resumed>) = 0 [pid 891] chdir("./19" [pid 890] <... futex resumed>) = 1 [pid 889] <... openat resumed>) = 5 [pid 888] <... futex resumed>) = 0 [pid 887] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 28.646305][ T876] EXT4-fs (loop0): get root inode failed [ 28.652519][ T876] EXT4-fs (loop0): mount failed [pid 296] mkdir("./20", 0777 [pid 893] set_robust_list(0x7f0c4a20e9a0, 24 [pid 892] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 891] <... chdir resumed>) = 0 [pid 890] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 889] ioctl(5, LOOP_SET_FD, 3 [pid 888] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 294] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 893] <... set_robust_list resumed>) = 0 [pid 892] <... prctl resumed>) = 0 [pid 891] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 890] <... mount resumed>) = 0 [pid 888] <... futex resumed>) = 0 [pid 887] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 893] rt_sigprocmask(SIG_SETMASK, [], [pid 892] setpgid(0, 0 [pid 891] <... prctl resumed>) = 0 [pid 890] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 294] newfstatat(AT_FDCWD, "./20/bus", [pid 893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 892] <... setpgid resumed>) = 0 [pid 891] setpgid(0, 0 [pid 890] <... futex resumed>) = 0 [pid 888] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 887] <... futex resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 893] memfd_create("syzkaller", 0 [pid 892] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 891] <... setpgid resumed>) = 0 [pid 890] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 888] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] unlink("./20/bus" [pid 893] <... memfd_create resumed>) = 3 [pid 892] <... openat resumed>) = 3 [pid 891] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 890] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 888] <... futex resumed>) = 0 [pid 887] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] close(3 [pid 893] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 892] write(3, "1000", 4 [pid 891] <... openat resumed>) = 3 [pid 890] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... close resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 892] <... write resumed>) = 4 [pid 891] write(3, "1000", 4 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 892] close(3 [pid 891] <... write resumed>) = 4 [pid 892] <... close resumed>) = 0 [pid 891] close(3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 894 [pid 892] symlink("/dev/binderfs", "./binderfs" [pid 891] <... close resumed>) = 0 [pid 893] <... mmap resumed>) = 0x7f0c41dcd000 [pid 892] <... symlink resumed>) = 0 [pid 891] symlink("/dev/binderfs", "./binderfs" [pid 887] <... mprotect resumed>) = 0 [pid 294] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 892] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] <... symlink resumed>) = 0 [pid 887] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 892] <... futex resumed>) = 0 [pid 891] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] <... rt_sigprocmask resumed>[], 8) = 0 [pid 294] newfstatat(AT_FDCWD, "./20/binderfs", [pid 893] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 892] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 891] <... futex resumed>) = 0 [pid 887] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 892] <... rt_sigaction resumed>NULL, 8) = 0 [pid 891] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 892] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 891] <... rt_sigaction resumed>NULL, 8) = 0 [pid 887] <... clone3 resumed> => {parent_tid=[895]}, 88) = 895 [pid 294] unlink("./20/binderfs" [pid 893] <... write resumed>) = 262144 [pid 892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 891] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 887] rt_sigprocmask(SIG_SETMASK, [], [pid 893] munmap(0x7f0c41dcd000, 138412032 [pid 892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 891] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 887] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] <... unlink resumed>) = 0 [pid 892] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 891] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 887] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 892] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 891] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 887] <... futex resumed>) = 0 ./strace-static-x86_64: Process 894 attached [pid 892] <... mprotect resumed>) = 0 [pid 891] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 887] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 894] set_robust_list(0x555556d8d6a0, 24 [pid 892] rt_sigprocmask(SIG_BLOCK, ~[], [pid 891] <... mprotect resumed>) = 0 [pid 294] close(3 [pid 894] <... set_robust_list resumed>) = 0 [pid 892] <... rt_sigprocmask resumed>[], 8) = 0 [pid 891] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... close resumed>) = 0 [pid 894] chdir("./20" [pid 893] <... munmap resumed>) = 0 [pid 892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 891] <... rt_sigprocmask resumed>[], 8) = 0 [pid 889] <... ioctl resumed>) = 0 [pid 894] <... chdir resumed>) = 0 [pid 893] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 891] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 890] <... open resumed>) = 6 [pid 889] close(3 [pid 294] rmdir("./20" [pid 894] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 893] <... openat resumed>) = 4 [pid 892] <... clone3 resumed> => {parent_tid=[896]}, 88) = 896 [pid 890] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] <... close resumed>) = 0 [pid 894] <... prctl resumed>) = 0 [pid 892] rt_sigprocmask(SIG_SETMASK, [], [pid 891] <... clone3 resumed> => {parent_tid=[897]}, 88) = 897 [pid 890] <... futex resumed>) = 1 [pid 889] mkdir("./bus", 0777 [pid 888] <... futex resumed>) = 0 ./strace-static-x86_64: Process 895 attached [pid 894] setpgid(0, 0 [pid 893] ioctl(4, LOOP_SET_FD, 3 [pid 892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 891] rt_sigprocmask(SIG_SETMASK, [], [pid 890] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 889] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 888] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... rmdir resumed>) = 0 [pid 894] <... setpgid resumed>) = 0 [pid 892] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 889] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 894] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 892] <... futex resumed>) = 0 [pid 891] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] <... openat resumed>) = 3 [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] <... futex resumed>) = 0 [pid 894] write(3, "1000", 4 [pid 892] <... futex resumed>) = 0 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] <... write resumed>) = 4 [pid 892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 891] <... futex resumed>) = 0 [pid 894] close(3 [pid 892] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 891] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 896 attached [pid 894] <... close resumed>) = 0 [pid 892] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 891] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 896] set_robust_list(0x7f0c4a20e9a0, 24 [pid 894] symlink("/dev/binderfs", "./binderfs" [pid 892] <... mprotect resumed>) = 0 [pid 891] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 896] <... set_robust_list resumed>) = 0 [pid 894] <... symlink resumed>) = 0 [pid 892] rt_sigprocmask(SIG_BLOCK, ~[], [pid 891] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 897 attached [pid 896] rt_sigprocmask(SIG_SETMASK, [], [pid 894] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 892] <... rt_sigprocmask resumed>[], 8) = 0 [pid 891] rt_sigprocmask(SIG_BLOCK, ~[], [pid 897] set_robust_list(0x7f0c4a20e9a0, 24 [pid 896] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 894] <... futex resumed>) = 0 [pid 892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 891] <... rt_sigprocmask resumed>[], 8) = 0 [pid 897] <... set_robust_list resumed>) = 0 [pid 896] memfd_create("syzkaller", 0 [pid 894] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 891] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 897] rt_sigprocmask(SIG_SETMASK, [], [pid 896] <... memfd_create resumed>) = 3 [pid 895] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 894] <... rt_sigaction resumed>NULL, 8) = 0 [pid 892] <... clone3 resumed> => {parent_tid=[898]}, 88) = 898 [pid 890] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 888] <... futex resumed>) = 0 [pid 294] mkdir("./21", 0777 [pid 897] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 896] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 894] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 892] rt_sigprocmask(SIG_SETMASK, [], [pid 891] <... clone3 resumed> => {parent_tid=[899]}, 88) = 899 [pid 890] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 897] memfd_create("syzkaller", 0 [pid 896] <... mmap resumed>) = 0x7f0c41dcd000 [pid 894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 891] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... mkdir resumed>) = 0 [pid 897] <... memfd_create resumed>) = 3 [pid 896] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 894] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 892] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 897] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 896] <... write resumed>) = 262144 [pid 894] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 892] <... futex resumed>) = 0 [pid 891] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... mmap resumed>) = 0x7f0c41dcd000 [pid 896] munmap(0x7f0c41dcd000, 138412032 [pid 894] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 891] <... futex resumed>) = 0 [pid 897] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 896] <... munmap resumed>) = 0 [pid 894] <... mprotect resumed>) = 0 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 897] <... write resumed>) = 262144 [pid 896] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 894] rt_sigprocmask(SIG_BLOCK, ~[], [pid 897] munmap(0x7f0c41dcd000, 138412032 [pid 896] <... openat resumed>) = 4 [pid 894] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 899 attached [pid 897] <... munmap resumed>) = 0 [pid 896] ioctl(4, LOOP_SET_FD, 3 [ 28.696049][ T889] loop3: detected capacity change from 0 to 512 [ 28.720215][ T893] loop4: detected capacity change from 0 to 512 [ 28.736949][ T896] loop5: detected capacity change from 0 to 512 [pid 894] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 899] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 897] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 895] <... set_robust_list resumed>) = 0 [pid 890] <... write resumed>) = 8 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 894] <... clone3 resumed> => {parent_tid=[901]}, 88) = 901 [pid 890] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... openat resumed>) = 3 [pid 890] <... futex resumed>) = 1 [pid 894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 890] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 888] <... futex resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 894] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 888] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 894] <... futex resumed>) = 0 [pid 890] <... futex resumed>) = 0 [pid 888] <... futex resumed>) = 1 [pid 294] close(3 [pid 894] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 890] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 888] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 894] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 894] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 890] <... write resumed>) = 1045 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 894] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 890] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... openat resumed>) = 4 [pid 894] <... mprotect resumed>) = 0 [pid 897] ioctl(4, LOOP_SET_FD, 3 [pid 894] rt_sigprocmask(SIG_BLOCK, ~[], [pid 890] <... futex resumed>) = 1 ./strace-static-x86_64: Process 903 attached ./strace-static-x86_64: Process 901 attached ./strace-static-x86_64: Process 898 attached [pid 899] <... set_robust_list resumed>) = 0 [pid 896] <... ioctl resumed>) = 0 [pid 895] rt_sigprocmask(SIG_SETMASK, [], [pid 894] <... rt_sigprocmask resumed>[], 8) = 0 [pid 893] <... ioctl resumed>) = 0 [pid 890] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 888] <... futex resumed>) = 0 [pid 887] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 903 [pid 903] set_robust_list(0x555556d8d6a0, 24 [pid 901] set_robust_list(0x7f0c4a20e9a0, 24 [pid 899] rt_sigprocmask(SIG_SETMASK, [], [pid 898] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 896] close(3 [pid 895] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 894] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 893] close(3 [pid 887] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] <... set_robust_list resumed>) = 0 [pid 901] <... set_robust_list resumed>) = 0 [pid 899] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 898] <... set_robust_list resumed>) = 0 [pid 897] <... ioctl resumed>) = 0 [pid 901] rt_sigprocmask(SIG_SETMASK, [], [pid 899] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 898] rt_sigprocmask(SIG_SETMASK, [], [pid 894] <... clone3 resumed> => {parent_tid=[904]}, 88) = 904 [pid 901] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 899] <... open resumed>) = 5 [pid 898] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 894] rt_sigprocmask(SIG_SETMASK, [], [pid 901] memfd_create("syzkaller", 0 [pid 899] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 901] <... memfd_create resumed>) = 3 [pid 899] <... futex resumed>) = 1 [pid 898] <... open resumed>) = 5 [pid 894] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] <... futex resumed>) = 0 [pid 901] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 899] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 898] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] <... futex resumed>) = 0 [pid 891] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] <... mmap resumed>) = 0x7f0c41dcd000 [pid 899] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 898] <... futex resumed>) = 1 [pid 894] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 892] <... futex resumed>) = 0 [pid 891] <... futex resumed>) = 0 ./strace-static-x86_64: Process 904 attached [pid 903] chdir("./21" [pid 901] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 899] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 898] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 897] close(3 [pid 896] <... close resumed>) = 0 [pid 895] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 893] <... close resumed>) = 0 [pid 892] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] <... futex resumed>) = 0 [pid 901] <... write resumed>) = 262144 [pid 899] <... mount resumed>) = 0 [pid 898] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 892] <... futex resumed>) = 0 [pid 901] munmap(0x7f0c41dcd000, 138412032 [pid 899] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 904] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 903] <... chdir resumed>) = 0 [pid 901] <... munmap resumed>) = 0 [pid 899] <... futex resumed>) = 1 [pid 898] <... mount resumed>) = 0 [pid 897] <... close resumed>) = 0 [pid 896] mkdir("./bus", 0777 [pid 895] <... open resumed>) = 3 [pid 893] mkdir("./bus", 0777 [pid 891] <... futex resumed>) = 0 [pid 887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 904] <... set_robust_list resumed>) = 0 [pid 903] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 901] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 899] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 898] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] mkdir("./bus", 0777 [pid 896] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 895] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 893] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 891] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 887] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 904] rt_sigprocmask(SIG_SETMASK, [], [pid 903] <... prctl resumed>) = 0 [pid 901] <... openat resumed>) = 4 [pid 899] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 898] <... futex resumed>) = 1 [pid 897] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 896] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 895] <... futex resumed>) = 0 [pid 893] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 892] <... futex resumed>) = 0 [pid 891] <... futex resumed>) = 0 [pid 887] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 904] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 903] setpgid(0, 0 [pid 901] ioctl(4, LOOP_SET_FD, 3 [pid 899] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 898] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 897] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 895] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 892] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 889] ioctl(5, LOOP_CLR_FD [pid 887] <... mprotect resumed>) = 0 [pid 904] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 903] <... setpgid resumed>) = 0 [pid 904] <... open resumed>) = 5 [pid 903] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 889] <... ioctl resumed>) = 0 [pid 904] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] <... openat resumed>) = 3 [pid 904] <... futex resumed>) = 1 [pid 903] write(3, "1000", 4 [pid 889] close(5 [pid 904] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 903] <... write resumed>) = 4 [pid 901] <... ioctl resumed>) = 0 [pid 899] <... open resumed>) = 3 [pid 898] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 894] <... futex resumed>) = 0 [pid 892] <... futex resumed>) = 0 [pid 887] rt_sigprocmask(SIG_BLOCK, ~[], [pid 901] close(3 [pid 899] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 894] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] <... rt_sigprocmask resumed>[], 8) = 0 [pid 901] <... close resumed>) = 0 [pid 899] <... futex resumed>) = 1 [pid 898] <... open resumed>) = 3 [pid 894] <... futex resumed>) = 1 [pid 891] <... futex resumed>) = 0 [pid 887] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 901] mkdir("./bus", 0777 [pid 899] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 898] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 891] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 899] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 898] <... futex resumed>) = 1 [pid 892] <... futex resumed>) = 0 [pid 891] <... futex resumed>) = 0 [pid 887] <... clone3 resumed> => {parent_tid=[905]}, 88) = 905 [pid 903] close(3 [pid 901] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 899] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 898] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 892] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] rt_sigprocmask(SIG_SETMASK, [], [pid 899] <... write resumed>) = 8 [pid 898] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 892] <... futex resumed>) = 0 [pid 887] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 899] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 904] <... futex resumed>) = 0 [pid 903] <... close resumed>) = 0 [pid 899] <... futex resumed>) = 1 [pid 898] <... write resumed>) = 8 [pid 891] <... futex resumed>) = 0 [pid 887] <... futex resumed>) = 0 [pid 904] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 903] symlink("/dev/binderfs", "./binderfs" [pid 899] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 898] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 904] <... mount resumed>) = 0 [pid 903] <... symlink resumed>) = 0 [pid 899] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 898] <... futex resumed>) = 1 [pid 892] <... futex resumed>) = 0 [pid 891] <... futex resumed>) = 0 [pid 899] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 898] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 892] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 891] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 899] <... write resumed>) = 1045 [pid 898] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 892] <... futex resumed>) = 0 [pid 899] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 892] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 899] <... futex resumed>) = 1 [pid 898] <... write resumed>) = 1045 [pid 891] <... futex resumed>) = 0 [pid 904] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 899] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 898] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 904] <... futex resumed>) = 1 [pid 903] <... futex resumed>) = 0 [pid 898] <... futex resumed>) = 1 [pid 894] <... futex resumed>) = 0 [pid 892] <... futex resumed>) = 0 [ 28.747863][ T897] loop1: detected capacity change from 0 to 512 [ 28.754667][ T889] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.769559][ T889] EXT4-fs (loop3): get root inode failed [ 28.775501][ T889] EXT4-fs (loop3): mount failed [ 28.784634][ T901] loop2: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 905 attached [pid 904] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 903] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 898] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 894] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] <... close resumed>) = 0 [pid 904] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 903] <... rt_sigaction resumed>NULL, 8) = 0 [pid 894] <... futex resumed>) = 0 [pid 889] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 905] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 904] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 903] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 894] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 889] <... futex resumed>) = 0 [ 28.805708][ T896] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.807577][ T897] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 28.820627][ T893] EXT4-fs (loop4): 1 orphan inode deleted [ 28.833987][ T901] EXT4-fs (loop2): 1 orphan inode deleted [ 28.838758][ T896] EXT4-fs (loop5): get root inode failed [pid 888] exit_group(0 [pid 905] <... set_robust_list resumed>) = 0 [pid 904] <... open resumed>) = 3 [pid 903] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 890] <... futex resumed>) = ? [pid 888] <... exit_group resumed>) = ? [pid 887] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 887] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 895] <... futex resumed>) = 0 [pid 887] <... futex resumed>) = 1 [pid 895] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 887] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 895] <... open resumed>) = 5 [pid 895] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 887] <... futex resumed>) = 0 [pid 895] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 887] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 887] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 905] rt_sigprocmask(SIG_SETMASK, [], [pid 904] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 890] +++ exited with 0 +++ [pid 889] +++ exited with 0 +++ [pid 905] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 904] <... futex resumed>) = 1 [pid 903] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 905] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 904] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 894] <... futex resumed>) = 0 [pid 903] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 905] <... mount resumed>) = 0 [pid 904] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 903] <... mprotect resumed>) = 0 [pid 894] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 901] ioctl(4, LOOP_CLR_FD [pid 895] <... write resumed>) = 8 [pid 901] <... ioctl resumed>) = 0 [pid 895] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] close(4 [pid 895] <... futex resumed>) = 1 [pid 887] <... futex resumed>) = 0 [pid 901] <... close resumed>) = 0 [pid 895] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [ 28.844134][ T901] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 28.849275][ T893] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 28.862487][ T901] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/20/bus supports timestamps until 2038 (0x7fffffff) [ 28.883219][ T893] ext4 filesystem being mounted at /root/syzkaller.qPQybd/19/bus supports timestamps until 2038 (0x7fffffff) [ 28.883736][ T897] EXT4-fs (loop1): get root inode failed [ 28.895086][ T896] EXT4-fs (loop5): mount failed [pid 887] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 905] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 904] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 901] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] <... futex resumed>) = 0 [pid 903] rt_sigprocmask(SIG_BLOCK, ~[], [pid 894] <... futex resumed>) = 0 [pid 905] <... futex resumed>) = 0 [pid 904] <... write resumed>) = 8 [pid 903] <... rt_sigprocmask resumed>[], 8) = 0 [pid 901] <... futex resumed>) = 0 [pid 894] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 904] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 905] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 904] <... futex resumed>) = 0 [pid 903] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 894] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 893] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 904] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 894] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 893] ioctl(4, LOOP_CLR_FD [pid 903] <... clone3 resumed> => {parent_tid=[914]}, 88) = 914 [pid 901] <... futex resumed>) = 0 [pid 895] <... write resumed>) = 1045 [pid 894] <... futex resumed>) = 1 [pid 903] rt_sigprocmask(SIG_SETMASK, [], [pid 901] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 896] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 895] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 894] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 914 attached [pid 903] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 897] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 896] ioctl(4, LOOP_CLR_FD [pid 895] <... futex resumed>) = 1 [pid 887] <... futex resumed>) = 0 [pid 903] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] <... write resumed>) = 1045 [pid 897] ioctl(4, LOOP_CLR_FD [pid 896] <... ioctl resumed>) = 0 [pid 895] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 903] <... futex resumed>) = 0 [pid 901] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 896] close(4 [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 896] <... close resumed>) = 0 [pid 903] <... futex resumed>) = 0 [pid 901] <... futex resumed>) = 1 [pid 896] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 894] <... futex resumed>) = 0 [pid 903] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 901] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 896] <... futex resumed>) = 0 [pid 903] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 897] <... ioctl resumed>) = 0 [pid 896] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 894] exit_group(0 [pid 904] <... futex resumed>) = ? [pid 903] <... mprotect resumed>) = 0 [pid 901] <... futex resumed>) = ? [pid 897] close(4 [pid 894] <... exit_group resumed>) = ? [pid 892] exit_group(0 [pid 904] +++ exited with 0 +++ [pid 898] <... futex resumed>) = ? [pid 897] <... close resumed>) = 0 [pid 892] <... exit_group resumed>) = ? [pid 903] rt_sigprocmask(SIG_BLOCK, ~[], [pid 898] +++ exited with 0 +++ [pid 897] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 896] <... futex resumed>) = ? [pid 897] <... futex resumed>) = 0 [pid 897] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 914] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 914] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 891] exit_group(0 [pid 899] <... futex resumed>) = ? [pid 897] <... futex resumed>) = ? [pid 891] <... exit_group resumed>) = ? [pid 914] memfd_create("syzkaller", 0 [pid 903] <... rt_sigprocmask resumed>[], 8) = 0 [pid 899] +++ exited with 0 +++ [pid 897] +++ exited with 0 +++ [pid 903] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0}./strace-static-x86_64: Process 915 attached [pid 914] <... memfd_create resumed>) = 3 [pid 915] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 903] <... clone3 resumed> => {parent_tid=[915]}, 88) = 915 [pid 914] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 915] <... set_robust_list resumed>) = 0 [pid 915] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 914] <... mmap resumed>) = 0x7f0c41dcd000 [pid 903] rt_sigprocmask(SIG_SETMASK, [], [pid 914] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 903] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 914] <... write resumed>) = 262144 [pid 903] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] +++ exited with 0 +++ [pid 896] +++ exited with 0 +++ [pid 894] +++ exited with 0 +++ [pid 893] <... ioctl resumed>) = 0 [pid 892] +++ exited with 0 +++ [pid 891] +++ exited with 0 +++ [pid 888] +++ exited with 0 +++ [pid 914] munmap(0x7f0c41dcd000, 138412032 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=892, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 915] <... futex resumed>) = 0 [pid 914] <... munmap resumed>) = 0 [pid 903] <... futex resumed>) = 1 [pid 893] close(4 [pid 915] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 914] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 915] <... open resumed>) = 5 [pid 914] <... openat resumed>) = 4 [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 893] <... close resumed>) = 0 [pid 299] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=888, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=894, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=891, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 915] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 28.906122][ T897] EXT4-fs (loop1): mount failed [pid 914] ioctl(4, LOOP_SET_FD, 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 915] <... futex resumed>) = 0 [pid 903] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 893] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] exit_group(0 [pid 299] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 905] <... futex resumed>) = ? [pid 903] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 895] <... futex resumed>) = ? [pid 893] <... futex resumed>) = ? [pid 887] <... exit_group resumed>) = ? [pid 299] <... openat resumed>) = 3 [pid 297] <... restart_syscall resumed>) = 0 [pid 915] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] newfstatat(3, "", [pid 915] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 915] <... mount resumed>) = 0 [pid 905] +++ exited with 0 +++ [pid 903] <... futex resumed>) = 0 [pid 895] +++ exited with 0 +++ [pid 299] getdents64(3, [pid 893] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 915] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 915] <... futex resumed>) = 0 [pid 299] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 914] <... ioctl resumed>) = 0 [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 296] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 914] close(3 [pid 903] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=887, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 914] <... close resumed>) = 0 [pid 903] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(3, "", [pid 295] newfstatat(3, "", [pid 915] <... futex resumed>) = 0 [pid 914] mkdir("./bus", 0777 [pid 903] <... futex resumed>) = 1 [pid 299] newfstatat(AT_FDCWD, "./21/bus", [pid 297] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 915] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 914] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 915] <... open resumed>) = 3 [pid 914] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] unlink("./21/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 915] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 298] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] <... futex resumed>) = 1 [pid 903] <... futex resumed>) = 0 [pid 299] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 903] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(3, "", [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 903] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./21/binderfs", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] getdents64(3, [pid 297] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./21/binderfs" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./20/bus", [pid 295] newfstatat(AT_FDCWD, "./19/bus", [pid 915] <... write resumed>) = 8 [pid 298] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 915] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./20/bus", [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 915] <... futex resumed>) = 1 [pid 903] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 298] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./20/bus" [pid 295] unlink("./19/bus" [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 903] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] unlink("./20/bus" [pid 915] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 903] <... futex resumed>) = 0 [pid 299] close(3 [pid 298] newfstatat(AT_FDCWD, "./19/bus", [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 915] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 903] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] <... write resumed>) = 1045 [pid 299] rmdir("./21" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 915] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./20/binderfs", [pid 295] newfstatat(AT_FDCWD, "./19/binderfs", [pid 915] <... futex resumed>) = 1 [pid 903] <... futex resumed>) = 0 [pid 299] mkdir("./22", 0777 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 915] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... mkdir resumed>) = 0 [pid 296] unlink("./20/binderfs" [pid 295] unlink("./19/binderfs" [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 295] close(3 [pid 299] close(3 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] unlink("./19/bus" [pid 297] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./20" [pid 295] rmdir("./19" [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 298] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./20/binderfs", [pid 296] mkdir("./21", 0777 [pid 295] mkdir("./20", 0777./strace-static-x86_64: Process 918 attached [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 918 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [ 28.935164][ T914] loop0: detected capacity change from 0 to 512 [ 28.971150][ T914] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 298] newfstatat(AT_FDCWD, "./19/binderfs", [pid 297] unlink("./20/binderfs" [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 298] unlink("./19/binderfs" [pid 297] getdents64(3, [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] getdents64(3, [pid 297] close(3 [pid 296] close(3 [pid 295] close(3 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 298] close(3 [pid 297] rmdir("./20" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 298] rmdir("./19" [pid 297] mkdir("./21", 0777 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 919 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 920 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 298] mkdir("./20", 0777 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] <... mkdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] <... openat resumed>) = 3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 298] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 918] set_robust_list(0x555556d8d6a0, 24 [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 921 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 922 [pid 918] <... set_robust_list resumed>) = 0 [pid 918] chdir("./22") = 0 [pid 918] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 920 attached ) = 0 ./strace-static-x86_64: Process 921 attached [pid 920] set_robust_list(0x555556d8d6a0, 24 [pid 918] setpgid(0, 0 [pid 921] set_robust_list(0x555556d8d6a0, 24 [pid 918] <... setpgid resumed>) = 0 [pid 918] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 919 attached [pid 921] <... set_robust_list resumed>) = 0 [pid 920] <... set_robust_list resumed>) = 0 [pid 918] <... openat resumed>) = 3 [pid 918] write(3, "1000", 4) = 4 [pid 918] close(3) = 0 [pid 918] symlink("/dev/binderfs", "./binderfs") = 0 [pid 918] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 918] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 918] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 918] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 918] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 ./strace-static-x86_64: Process 922 attached [pid 921] chdir("./21" [pid 920] chdir("./20" [pid 919] set_robust_list(0x555556d8d6a0, 24 [pid 918] rt_sigprocmask(SIG_BLOCK, ~[], [pid 922] set_robust_list(0x555556d8d6a0, 24 [pid 921] <... chdir resumed>) = 0 [pid 922] <... set_robust_list resumed>) = 0 [pid 921] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 922] chdir("./20" [pid 921] <... prctl resumed>) = 0 [pid 922] <... chdir resumed>) = 0 [pid 921] setpgid(0, 0 [pid 922] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 921] <... setpgid resumed>) = 0 [pid 922] <... prctl resumed>) = 0 [pid 921] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 922] setpgid(0, 0 [pid 921] <... openat resumed>) = 3 [pid 922] <... setpgid resumed>) = 0 [pid 921] write(3, "1000", 4 [pid 922] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 921] <... write resumed>) = 4 [pid 922] <... openat resumed>) = 3 [pid 921] close(3 [pid 922] write(3, "1000", 4 [pid 921] <... close resumed>) = 0 [pid 922] <... write resumed>) = 4 [pid 921] symlink("/dev/binderfs", "./binderfs" [pid 920] <... chdir resumed>) = 0 [pid 919] <... set_robust_list resumed>) = 0 [pid 918] <... rt_sigprocmask resumed>[], 8) = 0 [pid 922] close(3 [pid 921] <... symlink resumed>) = 0 [pid 920] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 919] chdir("./21" [pid 918] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 920] <... prctl resumed>) = 0 [pid 919] <... chdir resumed>) = 0 [pid 920] setpgid(0, 0 [pid 919] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 918] <... clone3 resumed> => {parent_tid=[923]}, 88) = 923 [pid 920] <... setpgid resumed>) = 0 [pid 919] <... prctl resumed>) = 0 [pid 918] rt_sigprocmask(SIG_SETMASK, [], [pid 920] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 919] setpgid(0, 0 [pid 918] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 920] <... openat resumed>) = 3 [pid 919] <... setpgid resumed>) = 0 [pid 918] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 920] write(3, "1000", 4 [pid 919] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 918] <... futex resumed>) = 0 [pid 920] <... write resumed>) = 4 [pid 919] <... openat resumed>) = 3 [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 920] close(3 [pid 919] write(3, "1000", 4 [pid 918] <... futex resumed>) = 0 [pid 920] <... close resumed>) = 0 [pid 919] <... write resumed>) = 4 [pid 918] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 920] symlink("/dev/binderfs", "./binderfs" [pid 919] close(3 [pid 918] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 920] <... symlink resumed>) = 0 [pid 919] <... close resumed>) = 0 [pid 918] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 920] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 919] symlink("/dev/binderfs", "./binderfs" [pid 918] <... mprotect resumed>) = 0 [pid 920] <... futex resumed>) = 0 [pid 919] <... symlink resumed>) = 0 [pid 918] rt_sigprocmask(SIG_BLOCK, ~[], [pid 920] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 919] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 918] <... rt_sigprocmask resumed>[], 8) = 0 [pid 920] <... rt_sigaction resumed>NULL, 8) = 0 [pid 919] <... futex resumed>) = 0 [pid 918] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 920] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 919] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 920] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 919] <... rt_sigaction resumed>NULL, 8) = 0 [pid 918] <... clone3 resumed> => {parent_tid=[924]}, 88) = 924 [pid 920] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 919] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 918] rt_sigprocmask(SIG_SETMASK, [], [pid 920] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 919] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 918] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 920] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 919] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 918] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 923 attached [pid 920] <... mprotect resumed>) = 0 [pid 919] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 918] <... futex resumed>) = 0 [pid 923] set_robust_list(0x7f0c4a20e9a0, 24 [pid 920] rt_sigprocmask(SIG_BLOCK, ~[], [pid 919] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 923] <... set_robust_list resumed>) = 0 [pid 920] <... rt_sigprocmask resumed>[], 8) = 0 [pid 919] <... mprotect resumed>) = 0 [pid 923] rt_sigprocmask(SIG_SETMASK, [], [pid 920] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 919] rt_sigprocmask(SIG_BLOCK, ~[], [pid 923] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 919] <... rt_sigprocmask resumed>[], 8) = 0 [pid 923] memfd_create("syzkaller", 0 [pid 920] <... clone3 resumed> => {parent_tid=[925]}, 88) = 925 [pid 919] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 923] <... memfd_create resumed>) = 3 [pid 920] rt_sigprocmask(SIG_SETMASK, [], [pid 923] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 920] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 919] <... clone3 resumed> => {parent_tid=[926]}, 88) = 926 [pid 923] <... mmap resumed>) = 0x7f0c41dcd000 [pid 920] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 919] rt_sigprocmask(SIG_SETMASK, [], [pid 923] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 920] <... futex resumed>) = 0 [pid 919] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 919] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 920] <... futex resumed>) = 0 [pid 919] <... futex resumed>) = 0 [pid 920] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 923] <... write resumed>) = 262144 [pid 920] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 919] <... futex resumed>) = 0 ./strace-static-x86_64: Process 924 attached [pid 923] munmap(0x7f0c41dcd000, 138412032 [pid 920] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 919] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 924] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 923] <... munmap resumed>) = 0 [pid 920] <... mprotect resumed>) = 0 [pid 919] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 924] <... set_robust_list resumed>) = 0 [pid 923] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 920] rt_sigprocmask(SIG_BLOCK, ~[], [pid 919] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 924] rt_sigprocmask(SIG_SETMASK, [], [pid 923] <... openat resumed>) = 4 [pid 920] <... rt_sigprocmask resumed>[], 8) = 0 [pid 919] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 925 attached [pid 924] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 923] ioctl(4, LOOP_SET_FD, 3 [ 28.984672][ T914] EXT4-fs error (device loop0): ext4_quota_enable:6369: comm syz-executor170: Bad quota inode: 3, type: 0 [ 29.013216][ T914] EXT4-fs warning (device loop0): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 29.027942][ T923] loop5: detected capacity change from 0 to 512 [pid 920] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 919] rt_sigprocmask(SIG_BLOCK, ~[], [pid 925] set_robust_list(0x7f0c4a20e9a0, 24 [pid 924] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 922] <... close resumed>) = 0 [pid 921] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 919] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 926 attached [pid 925] <... set_robust_list resumed>) = 0 [pid 924] <... open resumed>) = 5 [pid 920] <... clone3 resumed> => {parent_tid=[927]}, 88) = 927 [pid 919] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 926] set_robust_list(0x7f0c4a20e9a0, 24 [pid 925] rt_sigprocmask(SIG_SETMASK, [], [pid 924] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 920] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 919] <... clone3 resumed> => {parent_tid=[928]}, 88) = 928 [pid 920] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 919] rt_sigprocmask(SIG_SETMASK, [], [pid 920] <... futex resumed>) = 0 [pid 919] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 919] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 926] <... set_robust_list resumed>) = 0 [pid 925] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 924] <... futex resumed>) = 1 [pid 918] <... futex resumed>) = 0 [pid 926] rt_sigprocmask(SIG_SETMASK, [], [pid 925] memfd_create("syzkaller", 0 [pid 924] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 918] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 927 attached [pid 926] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 925] <... memfd_create resumed>) = 3 [pid 924] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 918] <... futex resumed>) = 0 [pid 927] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 926] memfd_create("syzkaller", 0 [pid 925] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 924] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 927] <... set_robust_list resumed>) = 0 [pid 926] <... memfd_create resumed>) = 3 [pid 925] <... mmap resumed>) = 0x7f0c41dcd000 [pid 924] <... mount resumed>) = 0 ./strace-static-x86_64: Process 928 attached [pid 927] rt_sigprocmask(SIG_SETMASK, [], [pid 926] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 925] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 924] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 923] <... ioctl resumed>) = 0 [pid 922] symlink("/dev/binderfs", "./binderfs" [pid 921] <... futex resumed>) = 0 [pid 914] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 928] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 927] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 926] <... mmap resumed>) = 0x7f0c41dcd000 [pid 925] <... write resumed>) = 262144 [pid 924] <... futex resumed>) = 1 [pid 923] close(3 [pid 922] <... symlink resumed>) = 0 [pid 921] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 918] <... futex resumed>) = 0 [pid 914] ioctl(4, LOOP_CLR_FD [pid 928] <... set_robust_list resumed>) = 0 [pid 927] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 924] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 923] <... close resumed>) = 0 [pid 922] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] <... rt_sigaction resumed>NULL, 8) = 0 [pid 914] <... ioctl resumed>) = 0 [pid 918] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] rt_sigprocmask(SIG_SETMASK, [], [pid 927] <... open resumed>) = 4 [pid 926] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 925] munmap(0x7f0c41dcd000, 138412032 [pid 923] mkdir("./bus", 0777 [pid 922] <... futex resumed>) = 0 [pid 921] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 914] close(4 [pid 928] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 927] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 926] <... write resumed>) = 262144 [pid 925] <... munmap resumed>) = 0 [pid 924] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 923] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 922] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 918] <... futex resumed>) = 0 [pid 914] <... close resumed>) = 0 [pid 928] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 927] <... futex resumed>) = 1 [pid 926] munmap(0x7f0c41dcd000, 138412032 [pid 925] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 923] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 922] <... rt_sigaction resumed>NULL, 8) = 0 [pid 921] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 920] <... futex resumed>) = 0 [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 914] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 903] exit_group(0 [pid 928] <... open resumed>) = 4 [pid 927] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 926] <... munmap resumed>) = 0 [pid 925] <... openat resumed>) = 5 [pid 924] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 922] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 921] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 920] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 915] <... futex resumed>) = ? [pid 914] <... futex resumed>) = ? [pid 903] <... exit_group resumed>) = ? [pid 927] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 922] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 921] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 920] <... futex resumed>) = 0 [pid 915] +++ exited with 0 +++ [pid 914] +++ exited with 0 +++ [pid 927] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 922] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 921] <... mprotect resumed>) = 0 [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 927] <... mount resumed>) = 0 [pid 924] <... open resumed>) = 3 [pid 922] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 921] rt_sigprocmask(SIG_BLOCK, ~[], [pid 927] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 921] <... rt_sigprocmask resumed>[], 8) = 0 [pid 924] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 927] <... futex resumed>) = 1 [pid 922] <... mprotect resumed>) = 0 [pid 921] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 920] <... futex resumed>) = 0 [pid 918] <... futex resumed>) = 0 [pid 924] <... futex resumed>) = 1 [pid 927] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 922] rt_sigprocmask(SIG_BLOCK, ~[], [pid 920] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 918] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 927] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 924] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 922] <... rt_sigprocmask resumed>[], 8) = 0 [pid 921] <... clone3 resumed> => {parent_tid=[929]}, 88) = 929 [pid 920] <... futex resumed>) = 0 [pid 918] <... futex resumed>) = 0 [pid 927] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 922] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 921] rt_sigprocmask(SIG_SETMASK, [], [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 927] <... open resumed>) = 6 [pid 921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 924] <... write resumed>) = 8 [pid 927] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] <... clone3 resumed> => {parent_tid=[930]}, 88) = 930 [pid 921] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 927] <... futex resumed>) = 1 [pid 924] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] rt_sigprocmask(SIG_SETMASK, [], [pid 921] <... futex resumed>) = 0 [pid 920] <... futex resumed>) = 0 [pid 927] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 922] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 920] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 918] <... futex resumed>) = 0 [pid 927] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 924] <... futex resumed>) = 1 [pid 922] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] <... futex resumed>) = 0 [pid 920] <... futex resumed>) = 0 [pid 918] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 927] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 922] <... futex resumed>) = 0 [pid 921] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 918] <... futex resumed>) = 0 [pid 924] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 927] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 918] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 927] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] <... futex resumed>) = 0 [pid 921] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 927] <... futex resumed>) = 1 [pid 924] <... write resumed>) = 1045 [pid 922] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 921] <... mprotect resumed>) = 0 [pid 920] <... futex resumed>) = 0 [pid 928] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 927] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 924] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 921] rt_sigprocmask(SIG_BLOCK, ~[], [pid 920] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] <... futex resumed>) = 1 [pid 927] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 924] <... futex resumed>) = 1 [pid 922] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 921] <... rt_sigprocmask resumed>[], 8) = 0 [pid 920] <... futex resumed>) = 0 [pid 919] <... futex resumed>) = 0 [pid 918] <... futex resumed>) = 0 [ 29.029147][ T914] EXT4-fs (loop0): mount failed [pid 928] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 927] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 925] ioctl(5, LOOP_SET_FD, 3 [pid 924] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 922] <... mprotect resumed>) = 0 [pid 926] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 921] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 920] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 919] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 930 attached [pid 928] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 927] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 922] rt_sigprocmask(SIG_BLOCK, ~[], [pid 930] set_robust_list(0x7f0c4a20e9a0, 24 [pid 927] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] <... rt_sigprocmask resumed>[], 8) = 0 [pid 921] <... clone3 resumed> => {parent_tid=[933]}, 88) = 933 [pid 930] <... set_robust_list resumed>) = 0 [pid 927] <... futex resumed>) = 1 [pid 922] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 921] rt_sigprocmask(SIG_SETMASK, [], [pid 920] <... futex resumed>) = 0 [pid 930] rt_sigprocmask(SIG_SETMASK, [], [pid 927] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 930] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 922] <... clone3 resumed> => {parent_tid=[934]}, 88) = 934 [pid 921] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 930] memfd_create("syzkaller", 0 [pid 922] rt_sigprocmask(SIG_SETMASK, [], [pid 921] <... futex resumed>) = 0 [pid 930] <... memfd_create resumed>) = 3 [pid 922] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 930] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 922] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 930] <... mmap resumed>) = 0x7f0c41dcd000 [pid 922] <... futex resumed>) = 0 [pid 930] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 930] <... write resumed>) = 262144 [pid 930] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 930] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 930] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 934 attached ./strace-static-x86_64: Process 933 attached ./strace-static-x86_64: Process 929 attached [pid 928] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 926] <... openat resumed>) = 5 [pid 925] <... ioctl resumed>) = 0 [pid 919] <... futex resumed>) = 0 [pid 929] set_robust_list(0x7f0c4a20e9a0, 24 [pid 928] <... mount resumed>) = 0 [pid 926] ioctl(5, LOOP_SET_FD, 3 [pid 925] close(3 [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 929] <... set_robust_list resumed>) = 0 [pid 928] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] <... close resumed>) = 0 [pid 919] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 929] rt_sigprocmask(SIG_SETMASK, [], [pid 928] <... futex resumed>) = 0 [pid 925] mkdir("./bus", 0777 [pid 919] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 934] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 933] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 929] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 928] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 925] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 919] <... futex resumed>) = 0 [pid 934] <... set_robust_list resumed>) = 0 [pid 933] <... set_robust_list resumed>) = 0 [pid 930] <... ioctl resumed>) = 0 [pid 929] memfd_create("syzkaller", 0 [pid 925] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 903] +++ exited with 0 +++ [pid 934] rt_sigprocmask(SIG_SETMASK, [], [pid 933] rt_sigprocmask(SIG_SETMASK, [], [pid 929] <... memfd_create resumed>) = 3 [pid 934] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 933] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 929] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=903, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 934] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 933] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 929] <... mmap resumed>) = 0x7f0c41dcd000 [pid 294] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 934] <... open resumed>) = 5 [pid 933] <... open resumed>) = 4 [pid 929] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 934] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 930] close(3 [pid 929] <... write resumed>) = 262144 [pid 923] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 294] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 934] <... futex resumed>) = 1 [pid 933] <... futex resumed>) = 1 [pid 930] <... close resumed>) = 0 [pid 929] munmap(0x7f0c41dcd000, 138412032 [pid 923] ioctl(4, LOOP_CLR_FD [pid 922] <... futex resumed>) = 0 [pid 921] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 934] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 933] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 930] mkdir("./bus", 0777 [pid 929] <... munmap resumed>) = 0 [pid 923] <... ioctl resumed>) = 0 [pid 922] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] newfstatat(3, "", [pid 934] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 933] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 930] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 929] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 928] <... open resumed>) = 6 [pid 926] <... ioctl resumed>) = 0 [pid 922] <... futex resumed>) = 0 [pid 921] <... futex resumed>) = 0 [pid 934] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 933] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 930] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 929] <... openat resumed>) = 5 [pid 928] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 926] close(3 [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 934] <... mount resumed>) = 0 [pid 933] <... mount resumed>) = 0 [pid 929] ioctl(5, LOOP_SET_FD, 3 [pid 928] <... futex resumed>) = 1 [pid 923] close(4 [pid 919] <... futex resumed>) = 0 [pid 294] getdents64(3, [pid 934] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 926] <... close resumed>) = 0 [pid 919] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 29.059454][ T923] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.074927][ T925] loop1: detected capacity change from 0 to 512 [ 29.078086][ T930] loop4: detected capacity change from 0 to 512 [ 29.084406][ T926] loop2: detected capacity change from 0 to 512 [ 29.087399][ T923] EXT4-fs (loop5): get root inode failed [ 29.098847][ T923] EXT4-fs (loop5): mount failed [pid 926] mkdir("./bus", 0777 [pid 919] <... futex resumed>) = 0 [pid 928] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 926] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 928] <... write resumed>) = 8 [pid 926] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 928] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 919] <... futex resumed>) = 0 [pid 928] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 919] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 919] <... futex resumed>) = 0 [pid 928] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 919] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 928] <... write resumed>) = 1045 [pid 928] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 919] <... futex resumed>) = 0 [pid 928] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 934] <... futex resumed>) = 1 [pid 933] <... futex resumed>) = 1 [pid 929] <... ioctl resumed>) = 0 [pid 923] <... close resumed>) = 0 [pid 921] <... futex resumed>) = 0 [pid 922] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 934] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 933] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 923] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 929] close(3) = 0 [pid 929] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 929] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 918] exit_group(0 [pid 924] <... futex resumed>) = ? [pid 918] <... exit_group resumed>) = ? [pid 924] +++ exited with 0 +++ [pid 923] <... futex resumed>) = ? [pid 922] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = 0 [pid 922] <... futex resumed>) = 1 [pid 934] <... futex resumed>) = 0 [pid 933] <... futex resumed>) = 0 [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 921] <... futex resumed>) = 1 [pid 294] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 934] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 933] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 934] <... open resumed>) = 3 [pid 933] <... open resumed>) = 3 [pid 294] newfstatat(AT_FDCWD, "./21/bus", [pid 934] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 934] <... futex resumed>) = 1 [pid 933] <... futex resumed>) = 1 [pid 922] <... futex resumed>) = 0 [pid 921] <... futex resumed>) = 0 [pid 933] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 921] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] unlink("./21/bus" [pid 934] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 921] <... futex resumed>) = 0 [pid 922] <... futex resumed>) = 0 [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... unlink resumed>) = 0 [pid 933] <... write resumed>) = 8 [pid 933] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 934] <... write resumed>) = 8 [pid 933] <... futex resumed>) = 1 [pid 294] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 921] <... futex resumed>) = 0 [pid 934] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 934] <... futex resumed>) = 1 [pid 933] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 922] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 934] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 933] <... write resumed>) = 1045 [pid 922] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 921] <... futex resumed>) = 0 [ 29.115001][ T929] loop3: detected capacity change from 0 to 512 [ 29.122597][ T926] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.141447][ T930] EXT4-fs (loop4): 1 orphan inode deleted [ 29.142071][ T926] EXT4-fs (loop2): get root inode failed [ 29.147470][ T930] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] newfstatat(AT_FDCWD, "./21/binderfs", [pid 934] <... write resumed>) = 1045 [pid 933] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] <... futex resumed>) = 0 [pid 921] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 923] +++ exited with 0 +++ [pid 918] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=918, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 934] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 934] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 933] <... futex resumed>) = 0 [pid 933] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 922] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 921] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] unlink("./21/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./21") = 0 [pid 294] mkdir("./22", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] <... umount2 resumed>) = 0 [pid 294] close(3 [pid 299] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./22/bus") = 0 [pid 299] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./22/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./22") = 0 [pid 299] mkdir("./23", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 943 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 944 [pid 926] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 926] ioctl(5, LOOP_CLR_FD) = 0 [pid 926] close(5) = 0 [pid 926] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 29.153398][ T926] EXT4-fs (loop2): mount failed [ 29.164507][ T930] ext4 filesystem being mounted at /root/syzkaller.qPQybd/20/bus supports timestamps until 2038 (0x7fffffff) [ 29.183375][ T925] EXT4-fs (loop1): 1 orphan inode deleted [ 29.192647][ T929] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 926] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 944 attached ./strace-static-x86_64: Process 943 attached [pid 944] set_robust_list(0x555556d8d6a0, 24 [pid 943] set_robust_list(0x555556d8d6a0, 24 [pid 929] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 919] exit_group(0 [pid 944] <... set_robust_list resumed>) = 0 [pid 943] <... set_robust_list resumed>) = 0 [pid 928] <... futex resumed>) = ? [pid 919] <... exit_group resumed>) = ? [pid 944] chdir("./22" [pid 943] chdir("./23" [pid 928] +++ exited with 0 +++ [pid 944] <... chdir resumed>) = 0 [pid 943] <... chdir resumed>) = 0 [pid 944] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 943] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 944] <... prctl resumed>) = 0 [pid 943] <... prctl resumed>) = 0 [pid 944] setpgid(0, 0 [pid 943] setpgid(0, 0 [pid 944] <... setpgid resumed>) = 0 [pid 943] <... setpgid resumed>) = 0 [pid 944] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 943] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 944] <... openat resumed>) = 3 [pid 943] <... openat resumed>) = 3 [pid 944] write(3, "1000", 4 [pid 943] write(3, "1000", 4 [pid 944] <... write resumed>) = 4 [pid 943] <... write resumed>) = 4 [pid 944] close(3 [pid 943] close(3 [pid 944] <... close resumed>) = 0 [pid 943] <... close resumed>) = 0 [pid 944] symlink("/dev/binderfs", "./binderfs" [pid 943] symlink("/dev/binderfs", "./binderfs" [pid 944] <... symlink resumed>) = 0 [pid 943] <... symlink resumed>) = 0 [pid 944] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 926] <... futex resumed>) = ? [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 944] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 943] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 944] <... rt_sigaction resumed>NULL, 8) = 0 [pid 943] <... rt_sigaction resumed>NULL, 8) = 0 [pid 944] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 943] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 944] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 943] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 944] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 943] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 944] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 943] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 944] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 943] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 944] <... mprotect resumed>) = 0 [pid 943] <... mprotect resumed>) = 0 [pid 944] rt_sigprocmask(SIG_BLOCK, ~[], [pid 943] rt_sigprocmask(SIG_BLOCK, ~[], [pid 930] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 929] ioctl(5, LOOP_CLR_FD [pid 944] <... rt_sigprocmask resumed>[], 8) = 0 [pid 943] <... rt_sigprocmask resumed>[], 8) = 0 [pid 930] ioctl(4, LOOP_CLR_FD [pid 929] <... ioctl resumed>) = 0 [pid 944] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 943] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 930] <... ioctl resumed>) = 0 [pid 925] <... mount resumed>) = -1 ENOTDIR (Not a directory) ./strace-static-x86_64: Process 945 attached [pid 930] close(4 [pid 929] close(5 [pid 944] <... clone3 resumed> => {parent_tid=[945]}, 88) = 945 [pid 943] <... clone3 resumed> => {parent_tid=[946]}, 88) = 946 [pid 930] <... close resumed>) = 0 [pid 944] rt_sigprocmask(SIG_SETMASK, [], [pid 943] rt_sigprocmask(SIG_SETMASK, [], [pid 930] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] ioctl(5, LOOP_CLR_FD [pid 944] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 943] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 930] <... futex resumed>) = 0 [pid 922] exit_group(0 [pid 944] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 934] <... futex resumed>) = ? [pid 922] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 946 attached [pid 945] set_robust_list(0x7f0c4a20e9a0, 24 [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 934] +++ exited with 0 +++ [pid 930] +++ exited with 0 +++ [pid 929] <... close resumed>) = 0 [pid 925] <... ioctl resumed>) = 0 [pid 946] set_robust_list(0x7f0c4a20e9a0, 24 [pid 945] <... set_robust_list resumed>) = 0 [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 929] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] close(5 [pid 946] <... set_robust_list resumed>) = 0 [pid 945] rt_sigprocmask(SIG_SETMASK, [], [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 929] <... futex resumed>) = 0 [pid 925] <... close resumed>) = 0 [pid 944] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 943] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 925] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 944] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 943] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 925] <... futex resumed>) = 0 [pid 944] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 943] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 925] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 944] <... mprotect resumed>) = 0 [pid 943] <... mprotect resumed>) = 0 [pid 944] rt_sigprocmask(SIG_BLOCK, ~[], [pid 943] rt_sigprocmask(SIG_BLOCK, ~[], [pid 944] <... rt_sigprocmask resumed>[], 8) = 0 [pid 943] <... rt_sigprocmask resumed>[], 8) = 0 [pid 921] exit_group(0 [pid 920] exit_group(0 [pid 929] ????( [pid 946] rt_sigprocmask(SIG_SETMASK, [], [pid 945] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 944] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 943] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 927] <... futex resumed>) = ? [pid 925] <... futex resumed>) = ? [pid 921] <... exit_group resumed>) = ? [pid 920] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 948 attached ./strace-static-x86_64: Process 947 attached [pid 946] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 945] memfd_create("syzkaller", 0 [pid 933] <... futex resumed>) = ? [pid 929] <... ???? resumed>) = ? [pid 927] +++ exited with 0 +++ [pid 926] +++ exited with 0 +++ [pid 925] +++ exited with 0 +++ [pid 919] +++ exited with 0 +++ [pid 948] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 947] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 946] memfd_create("syzkaller", 0 [pid 945] <... memfd_create resumed>) = 3 [pid 933] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=919, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 948] <... set_robust_list resumed>) = 0 [pid 947] <... set_robust_list resumed>) = 0 [pid 946] <... memfd_create resumed>) = 3 [pid 945] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 944] <... clone3 resumed> => {parent_tid=[947]}, 88) = 947 [pid 943] <... clone3 resumed> => {parent_tid=[948]}, 88) = 948 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 948] rt_sigprocmask(SIG_SETMASK, [], [pid 947] rt_sigprocmask(SIG_SETMASK, [], [pid 946] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 944] rt_sigprocmask(SIG_SETMASK, [], [pid 943] rt_sigprocmask(SIG_SETMASK, [], [pid 944] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 943] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 944] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 945] <... mmap resumed>) = 0x7f0c41dcd000 [pid 948] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 947] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 946] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... restart_syscall resumed>) = 0 [pid 948] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 947] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 945] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 946] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 945] <... write resumed>) = 262144 [ 29.193379][ T925] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 29.210078][ T929] EXT4-fs (loop3): get root inode failed [ 29.222239][ T929] EXT4-fs (loop3): mount failed [ 29.222944][ T925] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/20/bus supports timestamps until 2038 (0x7fffffff) [pid 947] <... open resumed>) = 4 [pid 945] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 945] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 945] ioctl(5, LOOP_SET_FD, 3 [pid 948] <... open resumed>) = 4 [pid 947] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 946] <... write resumed>) = 262144 [pid 948] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... futex resumed>) = 1 [pid 946] munmap(0x7f0c41dcd000, 138412032 [pid 296] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 948] <... futex resumed>) = 1 [pid 947] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] <... munmap resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 948] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 946] <... openat resumed>) = 5 [pid 296] <... openat resumed>) = 3 [pid 946] ioctl(5, LOOP_SET_FD, 3 [pid 296] newfstatat(3, "", [pid 945] <... ioctl resumed>) = 0 [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 945] close(3 [pid 944] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 945] <... close resumed>) = 0 [pid 944] <... futex resumed>) = 1 [pid 943] <... futex resumed>) = 1 [pid 945] mkdir("./bus", 0777 [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 945] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 945] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 947] <... futex resumed>) = 0 [pid 947] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 947] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 944] <... futex resumed>) = 0 [pid 947] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 944] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 944] <... futex resumed>) = 0 [pid 947] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 947] <... open resumed>) = 3 [pid 947] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 944] <... futex resumed>) = 0 [pid 947] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 944] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 944] <... futex resumed>) = 0 [pid 947] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 948] <... futex resumed>) = 0 [pid 947] <... write resumed>) = 8 [pid 946] <... ioctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 948] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 947] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 946] close(3 [pid 296] newfstatat(AT_FDCWD, "./21/bus", [pid 948] <... mount resumed>) = 0 [pid 947] <... futex resumed>) = 1 [pid 946] <... close resumed>) = 0 [pid 944] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 948] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] mkdir("./bus", 0777 [pid 944] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./21/bus" [pid 948] <... futex resumed>) = 1 [pid 947] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 944] <... futex resumed>) = 0 [pid 943] <... futex resumed>) = 0 [pid 948] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 943] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 948] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 947] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 946] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 944] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 943] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 948] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 947] <... write resumed>) = 1045 [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 948] <... open resumed>) = 3 [pid 947] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 948] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... futex resumed>) = 1 [pid 944] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./21/binderfs", [pid 948] <... futex resumed>) = 1 [pid 947] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 943] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 948] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 943] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./21/binderfs" [pid 948] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 943] <... futex resumed>) = 0 [pid 948] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 296] getdents64(3, [pid 948] <... write resumed>) = 8 [pid 948] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 948] <... futex resumed>) = 1 [pid 943] <... futex resumed>) = 0 [pid 296] close(3 [pid 948] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 943] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 948] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 943] <... futex resumed>) = 0 [pid 296] rmdir("./21" [pid 948] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 943] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... rmdir resumed>) = 0 [pid 948] <... write resumed>) = 1045 [pid 948] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] mkdir("./22", 0777 [pid 948] <... futex resumed>) = 1 [pid 943] <... futex resumed>) = 0 [pid 948] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 953 [ 29.269322][ T945] loop0: detected capacity change from 0 to 512 [ 29.275143][ T946] loop5: detected capacity change from 0 to 512 [ 29.289643][ T946] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.291437][ T945] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 ./strace-static-x86_64: Process 953 attached [pid 929] +++ exited with 0 +++ [pid 922] +++ exited with 0 +++ [pid 921] +++ exited with 0 +++ [pid 920] +++ exited with 0 +++ [pid 953] set_robust_list(0x555556d8d6a0, 24 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=922, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=921, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = 0 [pid 953] <... set_robust_list resumed>) = 0 [pid 298] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./20/bus", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(AT_FDCWD, "./21/bus", [pid 298] unlink("./20/bus" [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] unlink("./21/bus" [pid 298] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./20/binderfs", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(AT_FDCWD, "./21/binderfs", [pid 298] unlink("./20/binderfs" [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] unlink("./21/binderfs" [pid 298] getdents64(3, [pid 297] <... unlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] getdents64(3, [pid 298] close(3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 953] chdir("./22" [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=920, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 953] <... chdir resumed>) = 0 [pid 946] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] rmdir("./20" [pid 297] <... close resumed>) = 0 [pid 295] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 953] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 946] ioctl(5, LOOP_CLR_FD [pid 945] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] <... rmdir resumed>) = 0 [pid 297] rmdir("./21" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 953] <... prctl resumed>) = 0 [pid 946] <... ioctl resumed>) = 0 [pid 945] ioctl(5, LOOP_CLR_FD [pid 298] mkdir("./21", 0777 [pid 297] <... rmdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 953] setpgid(0, 0 [pid 946] close(5 [pid 945] <... ioctl resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] mkdir("./22", 0777 [pid 295] <... openat resumed>) = 3 [pid 953] <... setpgid resumed>) = 0 [pid 946] <... close resumed>) = 0 [pid 945] close(5 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... mkdir resumed>) = 0 [pid 295] newfstatat(3, "", [pid 953] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 946] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 945] <... close resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 953] <... openat resumed>) = 3 [pid 946] <... futex resumed>) = 0 [pid 945] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 943] exit_group(0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 953] write(3, "1000", 4 [pid 948] <... futex resumed>) = ? [pid 945] <... futex resumed>) = 0 [pid 943] <... exit_group resumed>) = ? [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] getdents64(3, [pid 953] <... write resumed>) = 4 [pid 948] +++ exited with 0 +++ [pid 946] +++ exited with 0 +++ [pid 945] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 944] exit_group(0 [pid 298] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 947] <... futex resumed>) = ? [pid 944] <... exit_group resumed>) = ? [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 953] close(3 [pid 947] +++ exited with 0 +++ [pid 945] <... futex resumed>) = ? [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 953] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 953] symlink("/dev/binderfs", "./binderfs" [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 954 [pid 295] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 953] <... symlink resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 955 [pid 953] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = 0 [pid 953] <... futex resumed>) = 0 [pid 295] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 953] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 953] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 295] newfstatat(AT_FDCWD, "./20/bus", [pid 953] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 953] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 953] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] unlink("./20/bus" [pid 953] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 295] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 955 attached ./strace-static-x86_64: Process 954 attached [pid 953] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 955] set_robust_list(0x555556d8d6a0, 24 [pid 953] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 953] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 955] <... set_robust_list resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./20/binderfs", [pid 954] set_robust_list(0x555556d8d6a0, 24 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 953] <... clone3 resumed> => {parent_tid=[956]}, 88) = 956 [pid 295] unlink("./20/binderfs" [pid 955] chdir("./22" [pid 953] rt_sigprocmask(SIG_SETMASK, [], [pid 954] <... set_robust_list resumed>) = 0 [pid 955] <... chdir resumed>) = 0 [pid 954] chdir("./21" [pid 953] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... unlink resumed>) = 0 [pid 955] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 954] <... chdir resumed>) = 0 [pid 953] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] getdents64(3, [pid 955] <... prctl resumed>) = 0 [pid 954] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 953] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 955] setpgid(0, 0 [pid 954] <... prctl resumed>) = 0 [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 955] <... setpgid resumed>) = 0 [pid 954] setpgid(0, 0 [pid 953] <... futex resumed>) = 0 [pid 954] <... setpgid resumed>) = 0 [pid 953] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... close resumed>) = 0 [pid 955] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 953] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] rmdir("./20" [pid 953] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 954] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 954] write(3, "1000", 4 [pid 295] <... rmdir resumed>) = 0 [pid 953] <... mprotect resumed>) = 0 [pid 295] mkdir("./21", 0777 [pid 954] <... write resumed>) = 4 [pid 953] rt_sigprocmask(SIG_BLOCK, ~[], [pid 954] close(3) = 0 [pid 954] symlink("/dev/binderfs", "./binderfs" [pid 295] <... mkdir resumed>) = 0 [pid 955] <... openat resumed>) = 3 [pid 954] <... symlink resumed>) = 0 [pid 953] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 955] write(3, "1000", 4 [pid 954] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 953] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 955] <... write resumed>) = 4 [pid 954] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 954] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, ./strace-static-x86_64: Process 956 attached [pid 955] close(3 [pid 954] <... rt_sigaction resumed>NULL, 8) = 0 [pid 953] <... clone3 resumed> => {parent_tid=[957]}, 88) = 957 [pid 295] ioctl(3, LOOP_CLR_FD [pid 953] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 955] <... close resumed>) = 0 [pid 953] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] close(3 [pid 956] set_robust_list(0x7f0c4a20e9a0, 24 [pid 954] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 956] <... set_robust_list resumed>) = 0 [pid 954] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 956] rt_sigprocmask(SIG_SETMASK, [], [pid 955] symlink("/dev/binderfs", "./binderfs" [pid 954] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 953] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 956] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 954] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 953] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 956] memfd_create("syzkaller", 0 [pid 955] <... symlink resumed>) = 0 [pid 954] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 956] <... memfd_create resumed>) = 3 [pid 954] <... mprotect resumed>) = 0 [pid 956] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 955] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] rt_sigprocmask(SIG_BLOCK, ~[], [pid 956] <... mmap resumed>) = 0x7f0c41dcd000 [pid 955] <... futex resumed>) = 0 [pid 954] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 958 attached ./strace-static-x86_64: Process 957 attached [pid 955] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 954] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 958 [pid 958] set_robust_list(0x555556d8d6a0, 24 [pid 957] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 955] <... rt_sigaction resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 959 attached [pid 958] <... set_robust_list resumed>) = 0 [pid 957] <... set_robust_list resumed>) = 0 [pid 956] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 955] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 954] <... clone3 resumed> => {parent_tid=[959]}, 88) = 959 [pid 959] set_robust_list(0x7f0c4a20e9a0, 24 [pid 958] chdir("./21" [pid 957] rt_sigprocmask(SIG_SETMASK, [], [pid 955] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 954] rt_sigprocmask(SIG_SETMASK, [], [pid 958] <... chdir resumed>) = 0 [pid 957] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 955] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 954] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 958] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 957] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 955] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 954] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 958] <... prctl resumed>) = 0 [pid 957] <... open resumed>) = 4 [pid 955] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 954] <... futex resumed>) = 0 [pid 958] setpgid(0, 0 [pid 957] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] <... mprotect resumed>) = 0 [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 958] <... setpgid resumed>) = 0 [pid 957] <... futex resumed>) = 1 [pid 955] rt_sigprocmask(SIG_BLOCK, ~[], [pid 954] <... futex resumed>) = 0 [pid 953] <... futex resumed>) = 0 [pid 959] <... set_robust_list resumed>) = 0 [pid 958] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 957] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 956] <... write resumed>) = 262144 [pid 955] <... rt_sigprocmask resumed>[], 8) = 0 [pid 954] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 953] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] rt_sigprocmask(SIG_SETMASK, [], [pid 958] <... openat resumed>) = 3 [pid 957] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 956] munmap(0x7f0c41dcd000, 138412032 [pid 955] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 954] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 953] <... futex resumed>) = 0 [pid 958] write(3, "1000", 4 [pid 957] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 954] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 960 attached [pid 959] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 958] <... write resumed>) = 4 [pid 957] <... mount resumed>) = 0 [pid 956] <... munmap resumed>) = 0 [pid 955] <... clone3 resumed> => {parent_tid=[960]}, 88) = 960 [pid 958] close(3 [pid 957] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 956] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 955] rt_sigprocmask(SIG_SETMASK, [], [pid 954] <... mprotect resumed>) = 0 [pid 958] <... close resumed>) = 0 [pid 957] <... futex resumed>) = 1 [pid 955] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 953] <... futex resumed>) = 0 [pid 958] symlink("/dev/binderfs", "./binderfs" [pid 957] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 955] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 953] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 960] set_robust_list(0x7f0c4a20e9a0, 24 [pid 959] memfd_create("syzkaller", 0 [pid 958] <... symlink resumed>) = 0 [pid 957] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 956] <... openat resumed>) = 5 [pid 955] <... futex resumed>) = 0 [pid 954] rt_sigprocmask(SIG_BLOCK, ~[], [pid 953] <... futex resumed>) = 0 [pid 958] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 957] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] <... rt_sigprocmask resumed>[], 8) = 0 [pid 956] ioctl(5, LOOP_SET_FD, 3 [pid 959] <... memfd_create resumed>) = 3 [pid 958] <... futex resumed>) = 0 [pid 957] <... open resumed>) = 6 [pid 955] <... futex resumed>) = 0 [pid 958] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 957] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 958] <... rt_sigaction resumed>NULL, 8) = 0 [pid 957] <... futex resumed>) = 1 [pid 955] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 953] <... futex resumed>) = 0 [pid 958] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 957] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 955] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 953] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 958] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 957] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 955] <... mprotect resumed>) = 0 [pid 953] <... futex resumed>) = 0 [pid 958] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 957] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 955] rt_sigprocmask(SIG_BLOCK, ~[], [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 958] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 957] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 955] <... rt_sigprocmask resumed>[], 8) = 0 [pid 958] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [ 29.304409][ T946] EXT4-fs (loop5): get root inode failed [ 29.321164][ T946] EXT4-fs (loop5): mount failed [ 29.326291][ T945] EXT4-fs (loop0): get root inode failed [ 29.332340][ T945] EXT4-fs (loop0): mount failed [pid 957] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 960] <... set_robust_list resumed>) = 0 [pid 959] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 958] <... mprotect resumed>) = 0 [pid 957] <... futex resumed>) = 1 [pid 956] <... ioctl resumed>) = 0 [pid 954] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 953] <... futex resumed>) = 0 [pid 945] +++ exited with 0 +++ [pid 944] +++ exited with 0 +++ [pid 943] +++ exited with 0 +++ ./strace-static-x86_64: Process 962 attached ./strace-static-x86_64: Process 961 attached [pid 960] rt_sigprocmask(SIG_SETMASK, [], [pid 959] <... mmap resumed>) = 0x7f0c41dcd000 [pid 958] rt_sigprocmask(SIG_BLOCK, ~[], [pid 957] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 956] close(3 [pid 953] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=944, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 962] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 961] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 960] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 959] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 958] <... rt_sigprocmask resumed>[], 8) = 0 [pid 957] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 956] <... close resumed>) = 0 [pid 955] <... clone3 resumed> => {parent_tid=[961]}, 88) = 961 [pid 954] <... clone3 resumed> => {parent_tid=[962]}, 88) = 962 [pid 953] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=943, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 962] <... set_robust_list resumed>) = 0 [pid 961] <... set_robust_list resumed>) = 0 [pid 960] memfd_create("syzkaller", 0 [pid 959] <... write resumed>) = 262144 [pid 958] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 957] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 956] mkdir("./bus", 0777 [pid 955] rt_sigprocmask(SIG_SETMASK, [], [pid 954] rt_sigprocmask(SIG_SETMASK, [], [pid 953] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 961] rt_sigprocmask(SIG_SETMASK, [], [pid 960] <... memfd_create resumed>) = 3 [pid 959] munmap(0x7f0c41dcd000, 138412032 [pid 957] <... write resumed>) = 1045 [pid 956] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 955] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 954] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 961] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 960] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 959] <... munmap resumed>) = 0 [pid 958] <... clone3 resumed> => {parent_tid=[963]}, 88) = 963 [pid 957] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 956] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 955] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 962] rt_sigprocmask(SIG_SETMASK, [], [pid 961] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 960] <... mmap resumed>) = 0x7f0c41dcd000 [pid 959] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 958] rt_sigprocmask(SIG_SETMASK, [], [pid 957] <... futex resumed>) = 1 [pid 954] <... futex resumed>) = 0 [pid 953] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 294] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 962] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 961] <... open resumed>) = 4 [pid 960] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 959] <... openat resumed>) = 4 [pid 958] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 957] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] newfstatat(3, "", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 962] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 961] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 960] <... write resumed>) = 262144 [pid 959] ioctl(4, LOOP_SET_FD, 3 [pid 958] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 963 attached [pid 962] <... open resumed>) = 5 [pid 961] <... futex resumed>) = 0 [pid 960] munmap(0x7f0c41dcd000, 138412032 [pid 299] getdents64(3, [pid 962] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 961] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 960] <... munmap resumed>) = 0 [pid 958] <... futex resumed>) = 0 [pid 955] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... openat resumed>) = 3 [pid 963] set_robust_list(0x7f0c4a20e9a0, 24 [pid 962] <... futex resumed>) = 1 [pid 960] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = 0 [pid 299] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(3, "", [pid 963] <... set_robust_list resumed>) = 0 [pid 962] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 961] <... futex resumed>) = 0 [pid 960] <... openat resumed>) = 5 [pid 959] <... ioctl resumed>) = 0 [pid 958] <... futex resumed>) = 0 [pid 955] <... futex resumed>) = 1 [pid 954] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 963] rt_sigprocmask(SIG_SETMASK, [], [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 29.368672][ T956] loop2: detected capacity change from 0 to 512 [ 29.394395][ T956] EXT4-fs (loop2): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [ 29.409977][ T959] loop4: detected capacity change from 0 to 512 [pid 961] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 960] ioctl(5, LOOP_SET_FD, 3 [pid 959] close(3 [pid 958] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] <... futex resumed>) = 0 [pid 299] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 963] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 962] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 961] <... mount resumed>) = 0 [pid 959] <... close resumed>) = 0 [pid 958] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 956] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 963] memfd_create("syzkaller", 0 [pid 962] <... mount resumed>) = 0 [pid 961] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] mkdir("./bus", 0777 [pid 958] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 956] ioctl(5, LOOP_CLR_FD [pid 299] newfstatat(AT_FDCWD, "./23/bus", [pid 963] <... memfd_create resumed>) = 3 [pid 962] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 961] <... futex resumed>) = 1 [pid 959] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 958] <... mprotect resumed>) = 0 [pid 956] <... ioctl resumed>) = 0 [pid 955] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 963] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 962] <... futex resumed>) = 1 [pid 961] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 959] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 958] rt_sigprocmask(SIG_BLOCK, ~[], [pid 956] close(5 [pid 955] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = 0 [pid 299] unlink("./23/bus" [pid 963] <... mmap resumed>) = 0x7f0c41dcd000 [pid 962] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 961] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] <... rt_sigprocmask resumed>[], 8) = 0 [pid 956] <... close resumed>) = 0 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 294] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 956] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = 0 [pid 299] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 956] <... futex resumed>) = 0 [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 956] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./23/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./23") = 0 [pid 299] mkdir("./24", 0777 [pid 960] <... ioctl resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 960] close(3 [pid 953] exit_group(0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 960] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 960] mkdir("./bus", 0777 [pid 299] ioctl(3, LOOP_CLR_FD [pid 960] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 960] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] close(3 [pid 963] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 961] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 958] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 957] <... futex resumed>) = ? [pid 956] <... futex resumed>) = ? [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 953] <... exit_group resumed>) = ? [pid 299] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 962] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 961] <... open resumed>) = 3 [pid 957] +++ exited with 0 +++ [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 965 [pid 962] <... open resumed>) = 3 [pid 961] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 958] <... clone3 resumed> => {parent_tid=[966]}, 88) = 966 [pid 294] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 965 attached [pid 965] set_robust_list(0x555556d8d6a0, 24 [pid 963] <... write resumed>) = 262144 [pid 962] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] munmap(0x7f0c41dcd000, 138412032 [pid 961] <... futex resumed>) = 1 [pid 958] rt_sigprocmask(SIG_SETMASK, [], [pid 955] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 963] <... munmap resumed>) = 0 [pid 962] <... futex resumed>) = 1 [pid 961] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 958] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 955] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./22/bus", [pid 963] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 962] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 961] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 963] <... openat resumed>) = 4 [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 961] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 958] <... futex resumed>) = 0 [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] <... futex resumed>) = 0 [pid 294] unlink("./22/bus" [pid 963] ioctl(4, LOOP_SET_FD, 3 [pid 962] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 961] <... write resumed>) = 8 [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... unlink resumed>) = 0 [pid 965] <... set_robust_list resumed>) = 0 [pid 965] chdir("./24") = 0 [pid 965] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 965] setpgid(0, 0) = 0 [pid 965] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 965] write(3, "1000", 4) = 4 [pid 965] close(3) = 0 [pid 965] symlink("/dev/binderfs", "./binderfs") = 0 [pid 965] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 965] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 965] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 965] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 965] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 965] rt_sigprocmask(SIG_BLOCK, ~[], [pid 961] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 965] <... rt_sigprocmask resumed>[], 8) = 0 [pid 965] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 962] <... write resumed>) = 8 [pid 961] <... futex resumed>) = 1 [pid 955] <... futex resumed>) = 0 [pid 294] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 969 attached ./strace-static-x86_64: Process 966 attached [pid 963] <... ioctl resumed>) = 0 [pid 962] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 961] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 955] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 969] set_robust_list(0x7f0c4a20e9a0, 24 [pid 966] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 963] close(3 [pid 962] <... futex resumed>) = 1 [pid 961] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 955] <... futex resumed>) = 0 [pid 954] <... futex resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./22/binderfs", [pid 969] <... set_robust_list resumed>) = 0 [pid 966] <... set_robust_list resumed>) = 0 [pid 963] <... close resumed>) = 0 [pid 962] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 961] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 955] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 969] rt_sigprocmask(SIG_SETMASK, [], [pid 966] rt_sigprocmask(SIG_SETMASK, [], [pid 963] mkdir("./file1", 0777 [pid 961] <... write resumed>) = 1045 [pid 954] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] unlink("./22/binderfs" [pid 969] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 966] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 963] <... mkdir resumed>) = 0 [pid 961] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... unlink resumed>) = 0 [pid 969] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 966] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 963] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 961] <... futex resumed>) = 1 [pid 955] <... futex resumed>) = 0 [pid 294] getdents64(3, [pid 966] <... open resumed>) = 3 [pid 962] <... futex resumed>) = 0 [pid 961] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 954] <... futex resumed>) = 1 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 966] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 962] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 954] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 965] <... clone3 resumed> => {parent_tid=[969]}, 88) = 969 [pid 294] close(3 [pid 966] <... futex resumed>) = 1 [pid 965] rt_sigprocmask(SIG_SETMASK, [], [pid 962] <... write resumed>) = 1045 [pid 958] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [ 29.426492][ T960] loop3: detected capacity change from 0 to 512 [ 29.455087][ T963] loop1: detected capacity change from 0 to 512 [ 29.465551][ T959] EXT4-fs (loop4): 1 orphan inode deleted [pid 966] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 965] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 962] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 958] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] rmdir("./22" [pid 966] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] <... futex resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 966] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] mkdir("./23", 0777 [pid 966] <... mount resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 966] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 966] <... futex resumed>) = 1 [pid 958] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 966] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 958] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] ioctl(3, LOOP_CLR_FD [pid 966] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] <... futex resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 966] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] close(3 [pid 966] <... open resumed>) = 5 [pid 294] <... close resumed>) = 0 [pid 966] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 966] <... futex resumed>) = 1 [pid 958] <... futex resumed>) = 0 [pid 966] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 958] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 971 [pid 966] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] <... futex resumed>) = 0 [pid 966] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 966] <... write resumed>) = 8 [pid 966] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 958] <... futex resumed>) = 0 [pid 966] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 958] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 966] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 958] <... futex resumed>) = 0 [pid 966] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 958] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 966] <... write resumed>) = 1045 [pid 966] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 958] <... futex resumed>) = 0 [pid 966] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 956] +++ exited with 0 +++ [pid 953] +++ exited with 0 +++ [pid 965] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 969] <... futex resumed>) = 0 [pid 965] <... futex resumed>) = 1 [pid 969] memfd_create("syzkaller", 0 [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 969] <... memfd_create resumed>) = 3 [pid 965] <... futex resumed>) = 0 [pid 969] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 965] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 969] <... mmap resumed>) = 0x7f0c41dee000 [pid 965] <... mmap resumed>) = 0x7f0c41dcd000 [pid 969] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 965] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 962] <... futex resumed>) = 1 [pid 969] <... write resumed>) = 262144 [pid 965] <... mprotect resumed>) = 0 [pid 969] munmap(0x7f0c41dee000, 138412032 [pid 965] rt_sigprocmask(SIG_BLOCK, ~[], [pid 969] <... munmap resumed>) = 0 [pid 965] <... rt_sigprocmask resumed>[], 8) = 0 [pid 969] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 965] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 969] <... openat resumed>) = 4 [pid 969] ioctl(4, LOOP_SET_FD, 3 [pid 965] <... clone3 resumed> => {parent_tid=[972]}, 88) = 972 ./strace-static-x86_64: Process 971 attached [pid 969] <... ioctl resumed>) = 0 [pid 962] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 954] <... futex resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=953, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 296] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 972 attached [pid 972] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 972] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 972] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 971] set_robust_list(0x555556d8d6a0, 24 [pid 969] close(3 [pid 965] rt_sigprocmask(SIG_SETMASK, [], [pid 971] <... set_robust_list resumed>) = 0 [pid 969] <... close resumed>) = 0 [pid 965] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... umount2 resumed>) = 0 [ 29.472316][ T959] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 29.484052][ T960] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.487340][ T969] loop5: detected capacity change from 0 to 512 [ 29.503372][ T959] ext4 filesystem being mounted at /root/syzkaller.qPQybd/21/bus supports timestamps until 2038 (0x7fffffff) [ 29.515982][ T960] EXT4-fs (loop3): get root inode failed [pid 971] chdir("./23" [pid 969] mkdir("./file1", 0777 [pid 965] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 971] <... chdir resumed>) = 0 [pid 972] <... futex resumed>) = 0 [pid 971] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 969] <... mkdir resumed>) = 0 [pid 965] <... futex resumed>) = 1 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 971] <... prctl resumed>) = 0 [pid 969] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(AT_FDCWD, "./22/bus", [pid 971] setpgid(0, 0 [pid 972] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 971] <... setpgid resumed>) = 0 [pid 972] <... open resumed>) = 3 [pid 971] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] unlink("./22/bus" [pid 972] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... openat resumed>) = 3 [pid 972] <... futex resumed>) = 1 [pid 971] write(3, "1000", 4 [pid 965] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 971] <... write resumed>) = 4 [pid 296] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 971] close(3 [pid 972] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 971] <... close resumed>) = 0 [pid 965] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 971] symlink("/dev/binderfs", "./binderfs" [pid 296] newfstatat(AT_FDCWD, "./22/binderfs", [pid 972] <... mount resumed>) = 0 [pid 971] <... symlink resumed>) = 0 [pid 965] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 971] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 972] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... futex resumed>) = 0 [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] unlink("./22/binderfs" [pid 972] <... futex resumed>) = 0 [pid 971] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 965] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... unlink resumed>) = 0 [pid 972] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 971] <... rt_sigaction resumed>NULL, 8) = 0 [pid 965] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(3, [pid 972] <... open resumed>) = 5 [pid 971] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 965] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 972] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 972] <... futex resumed>) = 0 [pid 971] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 965] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 972] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 971] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 965] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 972] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 971] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 965] <... futex resumed>) = 0 [pid 296] rmdir("./22" [pid 972] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 959] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 972] <... write resumed>) = 8 [pid 959] ioctl(4, LOOP_CLR_FD [pid 972] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] <... ioctl resumed>) = 0 [pid 972] <... futex resumed>) = 1 [pid 965] <... futex resumed>) = 0 [pid 959] close(4 [pid 972] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 971] <... mprotect resumed>) = 0 [pid 965] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 972] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 965] <... futex resumed>) = 0 [pid 959] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] exit_group(0 [pid 972] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 965] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 962] <... futex resumed>) = ? [pid 959] <... futex resumed>) = ? [pid 954] <... exit_group resumed>) = ? [pid 972] <... write resumed>) = 1045 [pid 971] rt_sigprocmask(SIG_BLOCK, ~[], [pid 963] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 962] +++ exited with 0 +++ [pid 960] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 959] +++ exited with 0 +++ [pid 296] mkdir("./23", 0777 [pid 971] <... rt_sigprocmask resumed>[], 8) = 0 [pid 963] ioctl(4, LOOP_CLR_FD [pid 960] ioctl(5, LOOP_CLR_FD [pid 296] <... mkdir resumed>) = 0 [pid 972] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 963] <... ioctl resumed>) = 0 [pid 960] <... ioctl resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 972] <... futex resumed>) = 1 [pid 965] <... futex resumed>) = 0 [pid 963] close(4 [pid 960] close(5 [pid 296] <... openat resumed>) = 3 [pid 972] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 971] <... clone3 resumed> => {parent_tid=[978]}, 88) = 978 [pid 963] <... close resumed>) = 0 [pid 960] <... close resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 971] rt_sigprocmask(SIG_SETMASK, [], [pid 963] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 960] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 971] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 963] <... futex resumed>) = 0 [pid 960] <... futex resumed>) = 0 [pid 296] close(3 [pid 971] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 960] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 958] exit_group(0 [pid 955] exit_group(0 [pid 296] <... close resumed>) = 0 [pid 971] <... futex resumed>) = 0 [pid 966] <... futex resumed>) = ? [pid 963] <... futex resumed>) = ? [pid 961] <... futex resumed>) = ? [pid 960] <... futex resumed>) = ? [pid 958] <... exit_group resumed>) = ? [pid 955] <... exit_group resumed>) = ? [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 966] +++ exited with 0 +++ [pid 963] +++ exited with 0 +++ [pid 961] +++ exited with 0 +++ [pid 960] +++ exited with 0 +++ [pid 971] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 979 [pid 971] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 971] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 971] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 971] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[980]}, 88) = 980 [pid 971] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 971] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 980 attached [pid 980] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 980] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 980] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 980] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... futex resumed>) = 0 [pid 971] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 980] <... futex resumed>) = 1 [pid 980] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 980] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... futex resumed>) = 0 [pid 971] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 980] <... futex resumed>) = 1 ./strace-static-x86_64: Process 979 attached [pid 980] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 979] set_robust_list(0x555556d8d6a0, 24 [pid 980] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 979] <... set_robust_list resumed>) = 0 [pid 971] <... futex resumed>) = 0 [pid 971] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 979] chdir("./23" [pid 980] <... futex resumed>) = 1 [pid 980] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 980] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... futex resumed>) = 0 [pid 971] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 971] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 980] <... futex resumed>) = 1 [pid 980] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 980] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] <... futex resumed>) = 0 [pid 980] <... futex resumed>) = 1 [pid 980] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 979] <... chdir resumed>) = 0 [pid 979] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 979] setpgid(0, 0) = 0 [pid 979] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 979] write(3, "1000", 4) = 4 [pid 979] close(3) = 0 [pid 979] symlink("/dev/binderfs", "./binderfs") = 0 [pid 979] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 979] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 979] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 979] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 979] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 979] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 979] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[981]}, 88) = 981 [pid 979] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 979] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 979] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 979] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 979] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 979] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[982]}, 88) = 982 [pid 979] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 979] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 981 attached [pid 981] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 981] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 981] memfd_create("syzkaller", 0) = 3 [pid 981] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 978 attached ./strace-static-x86_64: Process 982 attached [pid 982] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 978] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 978] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 978] memfd_create("syzkaller", 0) = 5 [ 29.518126][ T963] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.522743][ T960] EXT4-fs (loop3): mount failed [ 29.547065][ T963] EXT4-fs (loop1): get root inode failed [ 29.553220][ T963] EXT4-fs (loop1): mount failed [ 29.562062][ T969] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 978] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 978] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 978] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 978] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 978] ioctl(6, LOOP_SET_FD, 5 [pid 982] <... set_robust_list resumed>) = 0 [pid 981] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 978] <... ioctl resumed>) = 0 [pid 958] +++ exited with 0 +++ [pid 955] +++ exited with 0 +++ [pid 954] +++ exited with 0 +++ [pid 982] rt_sigprocmask(SIG_SETMASK, [], [pid 981] <... write resumed>) = 262144 [pid 982] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 981] munmap(0x7f0c41dcd000, 138412032 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=954, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=955, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=958, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 982] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 981] <... munmap resumed>) = 0 [pid 982] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 981] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 979] <... futex resumed>) = 0 [pid 982] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 981] <... openat resumed>) = 5 [pid 979] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 982] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 981] ioctl(5, LOOP_SET_FD, 3 [pid 979] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 982] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 978] close(5 [pid 969] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 969] ioctl(4, LOOP_CLR_FD [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 969] <... ioctl resumed>) = 0 [pid 298] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 295] <... openat resumed>) = 3 [pid 969] close(4 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] newfstatat(3, "", [pid 969] <... close resumed>) = 0 [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 969] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] getdents64(3, [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 969] <... futex resumed>) = 0 [pid 298] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 982] <... mount resumed>) = 0 [pid 981] <... ioctl resumed>) = 0 [pid 978] <... close resumed>) = 0 [pid 969] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 965] exit_group(0 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 982] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 972] <... futex resumed>) = ? [pid 969] <... futex resumed>) = ? [pid 965] <... exit_group resumed>) = ? [pid 981] close(3 [pid 978] mkdir("./file1", 0777 [pid 298] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 982] <... futex resumed>) = 1 [pid 981] <... close resumed>) = 0 [pid 979] <... futex resumed>) = 0 [pid 972] +++ exited with 0 +++ [pid 969] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 982] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 981] mkdir("./bus", 0777 [pid 979] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 978] <... mkdir resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./21/bus", [pid 297] newfstatat(AT_FDCWD, "./22/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 982] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 981] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 979] <... futex resumed>) = 0 [pid 978] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./21/bus", [pid 982] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 981] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./21/bus" [pid 297] unlink("./22/bus" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 982] <... open resumed>) = 3 [pid 298] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 295] unlink("./21/bus" [pid 982] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 982] <... futex resumed>) = 1 [pid 979] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 982] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 979] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./21/binderfs", [pid 297] newfstatat(AT_FDCWD, "./22/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 982] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 979] <... futex resumed>) = 0 [pid 982] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 982] <... write resumed>) = 8 [pid 982] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 979] <... futex resumed>) = 0 [pid 982] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 979] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 982] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 979] <... futex resumed>) = 0 [pid 982] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 979] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 982] <... write resumed>) = 1045 [pid 982] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 979] <... futex resumed>) = 0 [pid 982] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./21/binderfs", [pid 298] unlink("./21/binderfs" [pid 297] unlink("./22/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 297] <... unlink resumed>) = 0 [pid 295] unlink("./21/binderfs" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 298] close(3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] rmdir("./21" [pid 297] <... close resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./21/file1", [pid 298] <... rmdir resumed>) = 0 [pid 297] rmdir("./22" [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] mkdir("./22", 0777 [pid 297] <... rmdir resumed>) = 0 [pid 295] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... mkdir resumed>) = 0 [pid 297] mkdir("./23", 0777 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... openat resumed>) = 4 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 295] newfstatat(4, "", [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] getdents64(4, [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 985 attached [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 985 [pid 295] close(4 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 986 [pid 295] <... close resumed>) = 0 [pid 295] rmdir("./21/file1"./strace-static-x86_64: Process 986 attached [pid 985] set_robust_list(0x555556d8d6a0, 24 [pid 295] <... rmdir resumed>) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./21" [pid 986] set_robust_list(0x555556d8d6a0, 24 [pid 985] <... set_robust_list resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./22", 0777 [pid 985] chdir("./22" [pid 986] <... set_robust_list resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 986] chdir("./23" [pid 985] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 987 attached [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 987 [pid 986] <... chdir resumed>) = 0 [pid 985] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 987] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 987] chdir("./22") = 0 [pid 987] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 986] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 985] <... prctl resumed>) = 0 [pid 987] <... prctl resumed>) = 0 [pid 985] setpgid(0, 0 [pid 987] setpgid(0, 0) = 0 [pid 987] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 986] <... prctl resumed>) = 0 [pid 985] <... setpgid resumed>) = 0 [ 29.576353][ T969] EXT4-fs (loop5): get root inode failed [ 29.583443][ T978] loop0: detected capacity change from 0 to 512 [ 29.585226][ T969] EXT4-fs (loop5): mount failed [ 29.598227][ T981] loop2: detected capacity change from 0 to 512 [pid 987] <... openat resumed>) = 3 [pid 987] write(3, "1000", 4) = 4 [pid 987] close(3) = 0 [pid 987] symlink("/dev/binderfs", "./binderfs") = 0 [pid 987] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 987] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 987] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 987] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 987] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 987] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 987] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[990]}, 88) = 990 [pid 987] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 987] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 987] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 987] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 987] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 987] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 987] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[991]}, 88) = 991 [pid 987] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 987] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 987] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 990 attached [pid 990] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 990] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 990] memfd_create("syzkaller", 0) = 3 [pid 990] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 990] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 990] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 990] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 990] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 990] close(3) = 0 [pid 990] mkdir("./file1", 0777) = 0 [pid 990] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 986] setpgid(0, 0) = 0 [pid 986] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 986] write(3, "1000", 4) = 4 [pid 986] close(3) = 0 [pid 986] symlink("/dev/binderfs", "./binderfs") = 0 [pid 965] +++ exited with 0 +++ [pid 986] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 986] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 986] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 986] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 986] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 986] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 986] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[992]}, 88) = 992 [pid 986] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 986] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 986] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 986] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 986] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 986] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 986] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[993]}, 88) = 993 [pid 986] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 986] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 986] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 992 attached [pid 992] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 992] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 992] memfd_create("syzkaller", 0) = 3 [pid 992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 992] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 992] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 992] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 992] ioctl(4, LOOP_SET_FD, 3 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=965, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 992] <... ioctl resumed>) = 0 [pid 299] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 992] close(3 [pid 299] <... openat resumed>) = 3 [pid 992] <... close resumed>) = 0 [pid 299] newfstatat(3, "", [pid 992] mkdir("./file1", 0777 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 985] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 985] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./24/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 985] write(3, "1000", 4 [pid 299] unlink("./24/bus" [pid 985] <... write resumed>) = 4 [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 985] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 985] <... close resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./24/binderfs", [pid 985] symlink("/dev/binderfs", "./binderfs" [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 985] <... symlink resumed>) = 0 [pid 299] unlink("./24/binderfs") = 0 [pid 985] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 29.627444][ T981] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.635706][ T990] loop1: detected capacity change from 0 to 512 [ 29.642030][ T978] EXT4-fs (loop0): 1 orphan inode deleted [ 29.656299][ T992] loop3: detected capacity change from 0 to 512 [pid 299] newfstatat(AT_FDCWD, "./24/file1", [pid 985] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./24/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 991 attached [pid 987] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 985] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 299] close(3 [pid 985] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 985] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] rmdir("./24" [pid 985] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 985] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] mkdir("./25", 0777 [pid 985] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] <... mkdir resumed>) = 0 [pid 985] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 985] <... mprotect resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 985] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 993 attached [pid 992] <... mkdir resumed>) = 0 [pid 991] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 987] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 985] <... rt_sigprocmask resumed>[], 8) = 0 [pid 978] <... mount resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 993] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 992] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 991] <... set_robust_list resumed>) = 0 [pid 987] <... futex resumed>) = 0 [pid 986] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 978] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] close(3./strace-static-x86_64: Process 995 attached [pid 993] <... set_robust_list resumed>) = 0 [pid 991] rt_sigprocmask(SIG_SETMASK, [], [pid 987] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 986] <... futex resumed>) = 0 [pid 981] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 978] <... openat resumed>) = 5 [pid 299] <... close resumed>) = 0 [pid 995] set_robust_list(0x7f0c4a20e9a0, 24 [pid 993] rt_sigprocmask(SIG_SETMASK, [], [pid 991] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 987] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 986] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 985] <... clone3 resumed> => {parent_tid=[995]}, 88) = 995 [pid 981] ioctl(5, LOOP_CLR_FD [pid 978] chdir("./file1" [ 29.677365][ T978] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 29.679579][ T981] EXT4-fs (loop2): get root inode failed [ 29.688401][ T978] ext4 filesystem being mounted at /root/syzkaller.iF59aB/23/file1 supports timestamps until 2038 (0x7fffffff) [ 29.705951][ T981] EXT4-fs (loop2): mount failed [ 29.715812][ T990] EXT4-fs (loop1): 1 orphan inode deleted [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 995] <... set_robust_list resumed>) = 0 [pid 993] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 985] rt_sigprocmask(SIG_SETMASK, [], [pid 995] rt_sigprocmask(SIG_SETMASK, [], [pid 985] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 998 [pid 995] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 985] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 995] memfd_create("syzkaller", 0 [pid 985] <... futex resumed>) = 0 [pid 995] <... memfd_create resumed>) = 3 [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 995] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 985] <... futex resumed>) = 0 [pid 995] <... mmap resumed>) = 0x7f0c41dee000 [pid 985] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 995] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 985] <... mmap resumed>) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 998 attached [pid 995] <... write resumed>) = 262144 [pid 993] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 991] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 990] <... mount resumed>) = 0 [pid 987] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 986] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 985] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 981] <... ioctl resumed>) = 0 [pid 978] <... chdir resumed>) = 0 [pid 998] set_robust_list(0x555556d8d6a0, 24 [pid 995] munmap(0x7f0c41dee000, 138412032 [pid 993] <... open resumed>) = 3 [pid 991] <... open resumed>) = 3 [pid 990] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 987] <... mprotect resumed>) = 0 [pid 986] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 985] <... mprotect resumed>) = 0 [pid 981] close(5 [pid 978] ioctl(6, LOOP_CLR_FD [pid 998] <... set_robust_list resumed>) = 0 [pid 995] <... munmap resumed>) = 0 [pid 990] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 985] rt_sigprocmask(SIG_BLOCK, ~[], [pid 998] chdir("./25" [pid 995] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 990] ioctl(4, LOOP_CLR_FD [pid 985] <... rt_sigprocmask resumed>[], 8) = 0 [pid 998] <... chdir resumed>) = 0 [pid 995] <... openat resumed>) = 4 [pid 990] <... ioctl resumed>) = 0 [pid 985] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 998] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 995] ioctl(4, LOOP_SET_FD, 3 [pid 993] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 991] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 990] close(4 [pid 987] rt_sigprocmask(SIG_BLOCK, ~[], [pid 986] <... mprotect resumed>) = 0 [pid 981] <... close resumed>) = 0 [pid 978] <... ioctl resumed>) = 0 [pid 998] <... prctl resumed>) = 0 [pid 993] <... futex resumed>) = 0 [pid 991] <... futex resumed>) = 0 [pid 987] <... rt_sigprocmask resumed>[], 8) = 0 [pid 986] rt_sigprocmask(SIG_BLOCK, ~[], [pid 981] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 978] close(6 [pid 993] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 991] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 987] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 986] <... rt_sigprocmask resumed>[], 8) = 0 [pid 981] <... futex resumed>) = 0 [pid 978] <... close resumed>) = 0 [pid 986] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 981] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 978] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 987] <... clone3 resumed> => {parent_tid=[1001]}, 88) = 1001 [pid 978] <... futex resumed>) = 0 [pid 987] rt_sigprocmask(SIG_SETMASK, [], [pid 986] <... clone3 resumed> => {parent_tid=[1002]}, 88) = 1002 [pid 978] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 987] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 986] rt_sigprocmask(SIG_SETMASK, [], [pid 987] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 987] <... futex resumed>) = 0 [pid 986] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 987] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 986] <... futex resumed>) = 0 [pid 986] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1000 attached [pid 1000] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 1000] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1000] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 992] <... mount resumed>) = 0 [pid 992] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 992] ioctl(4, LOOP_CLR_FD) = 0 [pid 992] close(4) = 0 [pid 992] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 992] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 985] <... clone3 resumed> => {parent_tid=[1000]}, 88) = 1000 [pid 979] exit_group(0 [pid 971] exit_group(0 [pid 985] rt_sigprocmask(SIG_SETMASK, [], [pid 990] <... close resumed>) = 0 [pid 982] <... futex resumed>) = ? [pid 981] <... futex resumed>) = ? [pid 979] <... exit_group resumed>) = ? [pid 971] <... exit_group resumed>) = ? [pid 978] <... futex resumed>) = 230 [pid 990] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 982] +++ exited with 0 +++ [pid 980] <... futex resumed>) = ? [pid 978] +++ exited with 0 +++ [pid 981] +++ exited with 0 +++ [pid 980] +++ exited with 0 +++ [pid 985] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 971] +++ exited with 0 +++ [pid 998] setpgid(0, 0) = 0 [pid 985] <... futex resumed>) = 1 [pid 998] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 998] write(3, "1000", 4) = 4 [pid 998] close(3) = 0 [pid 998] symlink("/dev/binderfs", "./binderfs" [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=971, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1000] <... futex resumed>) = 0 [pid 990] <... futex resumed>) = 0 [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1000] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 990] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... restart_syscall resumed>) = 0 [pid 998] <... symlink resumed>) = 0 [pid 1000] <... open resumed>) = 5 [pid 998] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1000] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 998] <... futex resumed>) = 0 [pid 998] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1000] <... futex resumed>) = 1 [pid 985] <... futex resumed>) = 0 [pid 1000] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1000] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 985] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1000] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 985] <... futex resumed>) = 0 [pid 294] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 998] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1000] <... mount resumed>) = 0 [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1000] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... openat resumed>) = 3 [pid 1000] <... futex resumed>) = 0 [pid 985] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] newfstatat(3, "", [pid 1000] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 985] <... futex resumed>) = 0 [pid 998] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, [pid 998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 998] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] <... umount2 resumed>) = 0 [pid 998] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 294] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 998] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./23/bus", [pid 998] <... mprotect resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 998] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] unlink("./23/bus" [pid 998] <... rt_sigprocmask resumed>[], 8) = 0 [pid 998] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 294] <... unlink resumed>) = 0 [pid 294] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 998] <... clone3 resumed> => {parent_tid=[1003]}, 88) = 1003 [pid 998] rt_sigprocmask(SIG_SETMASK, [], [pid 294] unlink("./23/binderfs" [pid 998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 998] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... unlink resumed>) = 0 [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 998] <... futex resumed>) = 0 [pid 998] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 998] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 998] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 998] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1004]}, 88) = 1004 ./strace-static-x86_64: Process 1004 attached ./strace-static-x86_64: Process 1003 attached ./strace-static-x86_64: Process 1002 attached ./strace-static-x86_64: Process 1001 attached [pid 1000] <... open resumed>) = 6 [pid 998] rt_sigprocmask(SIG_SETMASK, [], [pid 1000] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1002] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 1004] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1003] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1001] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1000] <... futex resumed>) = 1 [pid 1002] <... set_robust_list resumed>) = 0 [pid 1001] <... set_robust_list resumed>) = 0 [pid 985] <... futex resumed>) = 0 [pid 1000] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 998] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1004] <... set_robust_list resumed>) = 0 [pid 1003] <... set_robust_list resumed>) = 0 [pid 1002] rt_sigprocmask(SIG_SETMASK, [], [pid 1001] rt_sigprocmask(SIG_SETMASK, [], [pid 995] <... ioctl resumed>) = 0 [pid 998] <... futex resumed>) = 0 [pid 985] <... futex resumed>) = 0 [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1000] <... write resumed>) = 8 [pid 1002] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1001] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1002] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1000] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1001] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1004] rt_sigprocmask(SIG_SETMASK, [], [pid 1003] rt_sigprocmask(SIG_SETMASK, [], [pid 1002] <... mount resumed>) = 0 [pid 1001] <... mount resumed>) = 0 [pid 1000] <... futex resumed>) = 1 [pid 995] close(3 [pid 985] <... futex resumed>) = 0 [pid 1004] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1003] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1002] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1001] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1000] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 995] <... close resumed>) = 0 [pid 985] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1004] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1003] memfd_create("syzkaller", 0 [pid 1002] <... futex resumed>) = 1 [pid 1001] <... futex resumed>) = 1 [pid 1000] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 995] mkdir("./bus", 0777 [pid 987] <... futex resumed>) = 0 [pid 986] <... futex resumed>) = 0 [pid 985] <... futex resumed>) = 0 [pid 1004] <... open resumed>) = 3 [pid 1000] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 987] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 990] <... futex resumed>) = 0 [pid 992] <... futex resumed>) = 0 [pid 987] <... futex resumed>) = 1 [pid 986] <... futex resumed>) = 1 [pid 1002] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1001] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 992] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 990] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 987] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 986] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1000] <... write resumed>) = 1045 [pid 1004] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1003] <... memfd_create resumed>) = 4 [pid 1000] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 995] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 992] <... open resumed>) = 4 [pid 990] <... open resumed>) = 4 [pid 1004] <... futex resumed>) = 1 [pid 1003] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1000] <... futex resumed>) = 1 [pid 998] <... futex resumed>) = 0 [pid 995] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 992] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [ 29.724333][ T990] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/22/file1 supports timestamps until 2038 (0x7fffffff) [ 29.741569][ T992] EXT4-fs (loop3): 1 orphan inode deleted [ 29.747392][ T992] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/23/file1 supports timestamps until 2038 (0x7fffffff) [ 29.752994][ T995] loop4: detected capacity change from 0 to 512 [pid 990] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 985] <... futex resumed>) = 0 [pid 1004] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1003] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1000] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 998] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 992] <... futex resumed>) = 1 [pid 990] <... futex resumed>) = 1 [pid 987] <... futex resumed>) = 0 [pid 986] <... futex resumed>) = 0 [pid 1004] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1003] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 998] <... futex resumed>) = 0 [pid 992] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 990] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 987] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 979] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 1004] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1003] <... write resumed>) = 262144 [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 992] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 990] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 987] <... futex resumed>) = 0 [pid 986] <... futex resumed>) = 0 [pid 294] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1004] <... futex resumed>) = 0 [pid 1003] munmap(0x7f0c41dcd000, 138412032 [pid 998] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 992] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 990] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 987] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 986] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=979, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1004] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1003] <... munmap resumed>) = 0 [pid 998] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 992] <... write resumed>) = 8 [pid 990] <... write resumed>) = 8 [pid 296] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./23/file1", [pid 1004] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1003] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 998] <... futex resumed>) = 0 [pid 992] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 990] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1004] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1003] <... openat resumed>) = 5 [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 992] <... futex resumed>) = 1 [pid 990] <... futex resumed>) = 1 [pid 987] <... futex resumed>) = 0 [pid 986] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1004] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1003] ioctl(5, LOOP_SET_FD, 4 [pid 992] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 990] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 987] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1004] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1003] <... ioctl resumed>) = 0 [pid 992] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 990] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 987] <... futex resumed>) = 0 [pid 986] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 294] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1004] <... futex resumed>) = 1 [pid 998] <... futex resumed>) = 0 [pid 995] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 992] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 990] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 987] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 986] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... openat resumed>) = 4 [pid 1004] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1003] close(4 [pid 998] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 995] ioctl(4, LOOP_CLR_FD [pid 992] <... write resumed>) = 1045 [pid 990] <... write resumed>) = 1045 [pid 296] getdents64(3, [pid 294] newfstatat(4, "", [pid 1004] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 998] <... futex resumed>) = 0 [pid 995] <... ioctl resumed>) = 0 [pid 992] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1004] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1003] <... close resumed>) = 0 [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 995] close(4 [pid 992] <... futex resumed>) = 1 [pid 990] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 986] <... futex resumed>) = 0 [pid 296] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(4, [pid 1004] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1003] mkdir("./file1", 0777 [pid 995] <... close resumed>) = 0 [pid 992] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 990] <... futex resumed>) = 1 [pid 987] <... futex resumed>) = 0 [pid 986] exit_group(0 [pid 296] <... umount2 resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1004] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1003] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 995] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 990] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 987] exit_group(0 [pid 986] <... exit_group resumed>) = ? [pid 992] <... futex resumed>) = ? [pid 1002] <... futex resumed>) = ? [pid 993] <... futex resumed>) = ? [pid 296] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(4, [pid 1004] <... futex resumed>) = 1 [pid 1003] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1001] <... futex resumed>) = ? [pid 998] <... futex resumed>) = 0 [pid 995] <... futex resumed>) = 0 [pid 991] <... futex resumed>) = ? [pid 990] <... futex resumed>) = ? [pid 987] <... exit_group resumed>) = ? [pid 985] exit_group(0 [pid 992] +++ exited with 0 +++ [pid 1002] +++ exited with 0 +++ [pid 993] +++ exited with 0 +++ [pid 990] +++ exited with 0 +++ [pid 986] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1004] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1001] +++ exited with 0 +++ [pid 998] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 991] +++ exited with 0 +++ [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 987] +++ exited with 0 +++ [pid 1004] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 998] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=986, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=987, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] close(4 [pid 1004] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1000] <... futex resumed>) = ? [pid 998] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 985] <... exit_group resumed>) = ? [pid 296] newfstatat(AT_FDCWD, "./23/bus", [pid 1004] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1000] +++ exited with 0 +++ [pid 294] <... close resumed>) = 0 [pid 1004] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1004] <... futex resumed>) = 1 [pid 998] <... futex resumed>) = 0 [pid 294] rmdir("./23/file1" [pid 1004] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./23/bus" [pid 295] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... rmdir resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 297] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 294] close(3 [pid 297] newfstatat(3, "", [pid 296] newfstatat(AT_FDCWD, "./23/binderfs", [pid 295] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] rmdir("./23" [pid 297] getdents64(3, [pid 296] unlink("./23/binderfs" [pid 295] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] mkdir("./24", 0777 [pid 297] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 295] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... mkdir resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] close(3 [pid 295] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] ioctl(3, LOOP_CLR_FD [pid 297] newfstatat(AT_FDCWD, "./23/bus", [pid 296] rmdir("./23" [pid 295] newfstatat(AT_FDCWD, "./22/bus", [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] close(3 [pid 297] unlink("./23/bus" [pid 296] mkdir("./24", 0777 [pid 295] unlink("./22/bus" [pid 294] <... close resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1006 [pid 297] newfstatat(AT_FDCWD, "./23/binderfs", [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] newfstatat(AT_FDCWD, "./22/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./23/binderfs" [pid 296] close(3 [pid 295] unlink("./22/binderfs"./strace-static-x86_64: Process 1006 attached [pid 297] <... unlink resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 1006] set_robust_list(0x555556d8d6a0, 24 [pid 297] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 1006] <... set_robust_list resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1006] chdir("./24" [pid 295] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1006] <... chdir resumed>) = 0 [pid 1006] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1006] setpgid(0, 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1008 [pid 1006] <... setpgid resumed>) = 0 [pid 1006] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1006] write(3, "1000", 4) = 4 [pid 1006] close(3) = 0 [pid 1006] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1006] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1006] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [ 29.787038][ T995] EXT4-fs (loop4): Invalid log block size: 2475723007 [ 29.804009][ T1003] loop5: detected capacity change from 0 to 512 [pid 1006] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1006] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1006] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1006] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1009]}, 88) = 1009 [pid 1006] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1006] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1006] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1006] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1006] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1010]}, 88) = 1010 [pid 1006] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1006] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1009 attached [pid 1009] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1009] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1009] memfd_create("syzkaller", 0) = 3 [pid 1009] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1009] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 995] +++ exited with 0 +++ [pid 985] +++ exited with 0 +++ [pid 1009] <... write resumed>) = 262144 [pid 1009] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1009] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 1009] ioctl(4, LOOP_SET_FD, 3 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=985, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1009] <... ioctl resumed>) = 0 [pid 1009] close(3) = 0 [pid 1009] mkdir("./file1", 0777) = 0 [pid 1009] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1008 attached [pid 1008] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1008] chdir("./24") = 0 [pid 1008] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1008] setpgid(0, 0) = 0 [pid 1008] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1008] write(3, "1000", 4) = 4 [pid 1008] close(3) = 0 [pid 1008] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1008] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1008] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1008] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1008] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1008] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1008] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1011]}, 88) = 1011 [pid 1008] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1008] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1008] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1008] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1008] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1012]}, 88) = 1012 [pid 1008] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1008] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1011 attached [pid 1011] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1011] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1011] memfd_create("syzkaller", 0) = 3 [pid 1011] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 298] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1011] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 298] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./22/bus") = 0 [pid 298] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./22/binderfs") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./22") = 0 [pid 298] mkdir("./23", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1011] <... write resumed>) = 262144 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1014 [pid 1011] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1011] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 1011] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1014 attached ./strace-static-x86_64: Process 1010 attached ) = 0 [pid 1011] close(3) = 0 [pid 1011] mkdir("./file1", 0777) = 0 [pid 1011] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1012 attached [pid 297] <... umount2 resumed>) = 0 [pid 1012] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1012] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1012] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1012] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1008] <... futex resumed>) = 0 [pid 1008] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1012] <... futex resumed>) = 1 [pid 1012] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1012] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1008] <... futex resumed>) = 0 [pid 1008] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1012] <... futex resumed>) = 1 [pid 1012] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1012] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1014] set_robust_list(0x555556d8d6a0, 24 [pid 297] newfstatat(AT_FDCWD, "./23/file1", [pid 1010] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1014] <... set_robust_list resumed>) = 0 [pid 1010] <... set_robust_list resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1014] chdir("./23" [pid 1010] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1014] <... chdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1014] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1010] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... openat resumed>) = 4 [pid 1014] <... prctl resumed>) = 0 [pid 1010] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 297] newfstatat(4, "", [pid 1014] setpgid(0, 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, [pid 1014] <... setpgid resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, [pid 1014] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1010] <... open resumed>) = 3 [pid 297] close(4) = 0 [pid 297] rmdir("./23/file1" [pid 1008] <... futex resumed>) = 0 [pid 1008] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... rmdir resumed>) = 0 [pid 1008] <... futex resumed>) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1006] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 297] getdents64(3, [pid 1006] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1006] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1006] <... futex resumed>) = 0 [pid 1006] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] close(3 [pid 1014] <... openat resumed>) = 3 [pid 1006] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 1014] write(3, "1000", 4 [pid 1006] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 297] <... close resumed>) = 0 [pid 1006] <... mprotect resumed>) = 0 [pid 1014] <... write resumed>) = 4 [pid 1006] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] rmdir("./23" [pid 1014] close(3 [pid 1006] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1006] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 1014] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 1006] <... clone3 resumed> => {parent_tid=[1017]}, 88) = 1017 [pid 1006] rt_sigprocmask(SIG_SETMASK, [], [pid 297] mkdir("./24", 0777 [pid 1006] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1006] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... mkdir resumed>) = 0 [pid 1014] symlink("/dev/binderfs", "./binderfs" [pid 1010] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 1014] <... symlink resumed>) = 0 [pid 1010] <... futex resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1012] <... futex resumed>) = 1 [pid 1012] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8./strace-static-x86_64: Process 1017 attached [pid 1017] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 1012] <... write resumed>) = 8 [pid 1012] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1008] <... futex resumed>) = 0 [pid 1008] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1008] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 29.844429][ T1003] EXT4-fs (loop5): 1 orphan inode deleted [ 29.854214][ T1009] loop0: detected capacity change from 0 to 512 [ 29.857998][ T1003] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/25/file1 supports timestamps until 2038 (0x7fffffff) [ 29.883098][ T1011] loop2: detected capacity change from 0 to 512 [pid 1012] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1017] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1017] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1017] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1006] <... futex resumed>) = 0 [pid 1006] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1017] <... futex resumed>) = 1 [pid 1017] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1014] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1014] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1014] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1014] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1014] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1014] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1014] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1019]}, 88) = 1019 [pid 1014] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1014] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1014] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1014] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1014] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1014] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1014] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1020]}, 88) = 1020 [pid 1014] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1014] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = 0 [pid 1014] <... futex resumed>) = 0 [pid 1014] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1019 attached [pid 1019] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1019] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1019] memfd_create("syzkaller", 0) = 3 [pid 1019] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1012] <... write resumed>) = 1045 [pid 295] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1012] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1012] <... futex resumed>) = 1 [pid 1008] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./22/file1", [pid 1012] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1019] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 295] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./22/file1" [pid 1003] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1003] ioctl(5, LOOP_CLR_FD [pid 295] <... rmdir resumed>) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1021 [pid 295] rmdir("./22" [pid 1019] <... write resumed>) = 262144 [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./23", 0777 [pid 1019] munmap(0x7f0c41dcd000, 138412032 [pid 295] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1010] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 295] <... openat resumed>) = 3 [pid 1010] <... open resumed>) = 5 [pid 295] ioctl(3, LOOP_CLR_FD [pid 1010] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1006] <... futex resumed>) = 0 [pid 1010] <... futex resumed>) = 1 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1006] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1010] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 295] close(3 [pid 1006] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1019] <... munmap resumed>) = 0 [pid 1010] <... write resumed>) = 8 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1022 [pid 1019] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 1010] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1006] <... futex resumed>) = 0 [pid 1006] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1006] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1010] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = 1045 [pid 1010] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1006] <... futex resumed>) = 0 [pid 1010] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1022 attached ./strace-static-x86_64: Process 1021 attached ./strace-static-x86_64: Process 1020 attached [ 29.907615][ T1009] EXT4-fs (loop0): 1 orphan inode deleted [ 29.928635][ T1011] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 29.935633][ T1009] ext4 filesystem being mounted at /root/syzkaller.iF59aB/24/file1 supports timestamps until 2038 (0x7fffffff) [pid 1019] ioctl(4, LOOP_SET_FD, 3 [pid 1022] set_robust_list(0x555556d8d6a0, 24 [pid 1021] set_robust_list(0x555556d8d6a0, 24 [pid 1020] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1009] <... mount resumed>) = 0 [pid 1021] <... set_robust_list resumed>) = 0 [pid 1009] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1021] chdir("./24" [pid 1009] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1021] <... chdir resumed>) = 0 [pid 1009] ioctl(4, LOOP_CLR_FD [pid 1021] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1009] <... ioctl resumed>) = 0 [pid 1021] <... prctl resumed>) = 0 [pid 1021] setpgid(0, 0 [pid 1009] close(4 [pid 1021] <... setpgid resumed>) = 0 [pid 1021] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1009] <... close resumed>) = 0 [pid 1021] <... openat resumed>) = 3 [pid 1009] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1021] write(3, "1000", 4 [pid 1009] <... futex resumed>) = 0 [pid 1006] exit_group(0 [pid 1021] <... write resumed>) = 4 [pid 1017] <... futex resumed>) = ? [pid 1010] <... futex resumed>) = ? [pid 1006] <... exit_group resumed>) = ? [pid 1021] close(3 [pid 1017] +++ exited with 0 +++ [pid 1010] +++ exited with 0 +++ [pid 1009] +++ exited with 0 +++ [pid 1006] +++ exited with 0 +++ [pid 1021] <... close resumed>) = 0 [pid 1021] symlink("/dev/binderfs", "./binderfs" [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1006, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1021] <... symlink resumed>) = 0 [pid 294] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1021] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1021] <... futex resumed>) = 0 [pid 294] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1021] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] <... openat resumed>) = 3 [pid 1021] <... rt_sigaction resumed>NULL, 8) = 0 [pid 294] newfstatat(3, "", [pid 1021] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1021] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] getdents64(3, [pid 1021] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1021] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 294] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1021] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1021] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1021] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1023]}, 88) = 1023 [pid 1021] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1021] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1021] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1021] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 1023 attached [pid 1022] <... set_robust_list resumed>) = 0 [pid 1021] <... mprotect resumed>) = 0 [pid 1020] <... set_robust_list resumed>) = 0 [pid 1014] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 294] <... umount2 resumed>) = 0 [pid 1023] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1014] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1023] <... set_robust_list resumed>) = 0 [pid 1014] <... futex resumed>) = 0 [pid 1023] rt_sigprocmask(SIG_SETMASK, [], [pid 1014] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1023] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1014] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 1023] memfd_create("syzkaller", 0 [pid 1022] chdir("./23" [pid 1021] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1020] rt_sigprocmask(SIG_SETMASK, [], [pid 1014] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 1011] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1003] <... ioctl resumed>) = 0 [pid 294] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1023] <... memfd_create resumed>) = 3 [pid 1014] <... mprotect resumed>) = 0 [pid 1011] ioctl(4, LOOP_CLR_FD [pid 1023] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1014] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1011] <... ioctl resumed>) = 0 [pid 1023] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1014] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1011] close(4 [pid 1023] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1022] <... chdir resumed>) = 0 [pid 1021] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1020] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1014] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 1011] <... close resumed>) = 0 [pid 1003] close(5 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1023] <... write resumed>) = 262144 [pid 1020] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1011] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1022] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1021] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1014] <... clone3 resumed> => {parent_tid=[1024]}, 88) = 1024 [pid 1011] <... futex resumed>) = 0 [pid 1003] <... close resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./24/bus", [pid 1020] <... open resumed>) = 5 [pid 1014] rt_sigprocmask(SIG_SETMASK, [], [pid 1011] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1008] exit_group(0 [pid 1022] <... prctl resumed>) = 0 [pid 1020] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1014] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1003] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1014] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1023] munmap(0x7f0c41dcd000, 138412032 [pid 1014] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1023] <... munmap resumed>) = 0 [pid 1023] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 1012] <... futex resumed>) = ? [pid 1008] <... exit_group resumed>) = ? [pid 1023] ioctl(4, LOOP_SET_FD, 3 [pid 1022] setpgid(0, 0 [pid 1021] <... clone3 resumed> => {parent_tid=[1025]}, 88) = 1025 [pid 1020] <... futex resumed>) = 0 [pid 1011] <... futex resumed>) = ? [pid 1003] <... futex resumed>) = 0 [pid 294] unlink("./24/bus"./strace-static-x86_64: Process 1025 attached [pid 1023] <... ioctl resumed>) = 0 [pid 1023] close(3) = 0 [pid 1023] mkdir("./file1", 0777 [pid 1022] <... setpgid resumed>) = 0 [pid 1021] rt_sigprocmask(SIG_SETMASK, [], [pid 1020] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1012] +++ exited with 0 +++ [pid 1023] <... mkdir resumed>) = 0 [pid 1023] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1019] <... ioctl resumed>) = 0 [pid 1019] close(3 [pid 1003] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 998] exit_group(0 [pid 1019] <... close resumed>) = 0 [pid 1019] mkdir("./bus", 0777 [pid 294] <... unlink resumed>) = 0 [pid 1021] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1022] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1021] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1004] <... futex resumed>) = ? [pid 1003] <... futex resumed>) = 0 [pid 998] <... exit_group resumed>) = ? [pid 1022] <... openat resumed>) = 3 [pid 1004] +++ exited with 0 +++ [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1003] +++ exited with 0 +++ [pid 1019] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1019] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1024 attached [pid 1024] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 998] +++ exited with 0 +++ [pid 1024] <... set_robust_list resumed>) = 0 [pid 1024] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=998, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1022] write(3, "1000", 4 [pid 1024] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1024] <... mount resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./24/binderfs", [pid 1022] <... write resumed>) = 4 [pid 1024] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1014] <... futex resumed>) = 0 [pid 1014] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1014] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1024] <... futex resumed>) = 1 [pid 1024] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1020] <... futex resumed>) = 0 [pid 299] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1022] close(3 [pid 1020] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1020] <... open resumed>) = 3 [pid 1022] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] unlink("./24/binderfs" [pid 1020] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... unlink resumed>) = 0 [pid 1020] <... futex resumed>) = 1 [pid 1014] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 1022] symlink("/dev/binderfs", "./binderfs" [pid 1020] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1014] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1020] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] newfstatat(3, "", [pid 1025] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1025] rt_sigprocmask(SIG_SETMASK, [], [pid 1022] <... symlink resumed>) = 0 [pid 1014] <... futex resumed>) = 0 [pid 1020] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1014] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1025] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1025] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 299] getdents64(3, [pid 1020] <... write resumed>) = 8 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 1020] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1022] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1025] <... open resumed>) = 3 [pid 1025] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1021] <... futex resumed>) = 0 [pid 1025] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1021] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1020] <... futex resumed>) = 1 [pid 1014] <... futex resumed>) = 0 [pid 1022] <... futex resumed>) = 0 [pid 1021] <... futex resumed>) = 1 [pid 1014] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1014] <... futex resumed>) = 0 [pid 1020] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 299] newfstatat(AT_FDCWD, "./25/binderfs", [pid 1022] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1014] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1020] <... write resumed>) = 1045 [pid 1022] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1022] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1020] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1022] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] unlink("./25/binderfs" [pid 1022] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1020] <... futex resumed>) = 1 [pid 1014] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 1020] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1022] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1022] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1022] <... mprotect resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./25/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1022] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] unlink("./25/file1") = 0 [pid 1022] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1025] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 1022] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 1022] <... clone3 resumed> => {parent_tid=[1027]}, 88) = 1027 ./strace-static-x86_64: Process 1027 attached [pid 1025] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1022] rt_sigprocmask(SIG_SETMASK, [], [pid 299] rmdir("./25" [pid 1022] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1027] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1025] <... mount resumed>) = 0 [pid 1022] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 1022] <... futex resumed>) = 0 [pid 299] mkdir("./26", 0777 [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 1022] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1022] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... openat resumed>) = 3 [pid 1022] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] ioctl(3, LOOP_CLR_FD [pid 1022] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1022] <... mprotect resumed>) = 0 [pid 299] close(3 [pid 1022] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... close resumed>) = 0 [pid 1022] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1022] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1029 [pid 1022] <... clone3 resumed> => {parent_tid=[1030]}, 88) = 1030 [pid 1022] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1022] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1025] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1021] <... futex resumed>) = 0 [pid 1021] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1025] <... futex resumed>) = 1 [pid 1025] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1025] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1021] <... futex resumed>) = 0 [pid 1025] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1021] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1027] <... set_robust_list resumed>) = 0 [pid 1027] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1027] memfd_create("syzkaller", 0) = 3 [pid 1027] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1025] <... write resumed>) = 8 [ 29.948718][ T1019] loop4: detected capacity change from 0 to 512 [ 29.959391][ T1011] EXT4-fs (loop2): get root inode failed [ 29.964768][ T1011] EXT4-fs (loop2): mount failed [ 29.975884][ T1023] loop3: detected capacity change from 0 to 512 [ 29.997546][ T1023] EXT4-fs (loop3): 1 orphan inode deleted [pid 1025] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1021] <... futex resumed>) = 0 [pid 1027] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1027] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1027] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 1027] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1030 attached ./strace-static-x86_64: Process 1029 attached [pid 1025] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1023] <... mount resumed>) = 0 [pid 1021] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1030] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1029] set_robust_list(0x555556d8d6a0, 24 [pid 1025] <... write resumed>) = 1045 [pid 1021] <... futex resumed>) = 0 [pid 1030] <... set_robust_list resumed>) = 0 [pid 1029] <... set_robust_list resumed>) = 0 [pid 1025] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1021] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1030] rt_sigprocmask(SIG_SETMASK, [], [pid 1029] chdir("./26" [pid 1025] <... futex resumed>) = 0 [pid 1021] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1030] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1029] <... chdir resumed>) = 0 [pid 1025] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1030] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1029] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1030] <... open resumed>) = 5 [pid 1029] <... prctl resumed>) = 0 [pid 1030] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] setpgid(0, 0 [pid 1030] <... futex resumed>) = 1 [pid 1029] <... setpgid resumed>) = 0 [pid 1022] <... futex resumed>) = 0 [pid 1030] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1029] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1022] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1030] <... mount resumed>) = 0 [pid 1029] <... openat resumed>) = 3 [pid 1022] <... futex resumed>) = 0 [pid 1030] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] write(3, "1000", 4 [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1030] <... futex resumed>) = 0 [pid 1029] <... write resumed>) = 4 [pid 1022] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1030] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1029] close(3 [pid 1022] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] <... close resumed>) = 0 [pid 1022] <... futex resumed>) = 0 [pid 1029] symlink("/dev/binderfs", "./binderfs" [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1029] <... symlink resumed>) = 0 [pid 1029] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1011] +++ exited with 0 +++ [pid 1008] +++ exited with 0 +++ [pid 1029] <... futex resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1008, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1029] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] <... umount2 resumed>) = 0 [pid 1029] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1029] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1029] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1029] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1029] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1029] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1029] <... clone3 resumed> => {parent_tid=[1033]}, 88) = 1033 [pid 296] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 1033 attached [pid 1023] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 294] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1023] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1023] ioctl(4, LOOP_CLR_FD) = 0 [pid 1023] close(4) = 0 [pid 1023] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1023] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1033] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1033] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1027] <... ioctl resumed>) = 0 [pid 1027] close(3) = 0 [pid 1027] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1027] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1030] <... open resumed>) = 6 [pid 1021] exit_group(0 [pid 296] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1030] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1025] <... futex resumed>) = ? [pid 1023] <... futex resumed>) = ? [pid 1021] <... exit_group resumed>) = ? [pid 296] newfstatat(3, "", [pid 294] newfstatat(AT_FDCWD, "./24/file1", [pid 1025] +++ exited with 0 +++ [pid 1023] +++ exited with 0 +++ [pid 1029] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1029] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1033] <... futex resumed>) = 0 [pid 1029] <... futex resumed>) = 1 [pid 1033] memfd_create("syzkaller", 0) = 3 [pid 1033] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 1033] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1029] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c41dcd000 [pid 1029] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1033] <... write resumed>) = 262144 [pid 1029] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1029] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} => {parent_tid=[1034]}, 88) = 1034 [pid 1029] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1029] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1033] munmap(0x7f0c41dee000, 138412032) = 0 [pid 1033] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [ 30.003849][ T1023] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/24/file1 supports timestamps until 2038 (0x7fffffff) [ 30.008308][ T1027] loop1: detected capacity change from 0 to 512 [ 30.031376][ T1019] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1033] ioctl(4, LOOP_SET_FD, 3 [pid 1030] <... futex resumed>) = 1 [pid 1022] <... futex resumed>) = 0 [pid 1021] +++ exited with 0 +++ [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1030] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1022] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1021, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 296] getdents64(3, [pid 294] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1022] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1034 attached [pid 1033] <... ioctl resumed>) = 0 [pid 1030] <... write resumed>) = 8 [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1034] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 1034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1030] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1022] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1034] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1033] close(3 [pid 1030] <... futex resumed>) = 0 [pid 1022] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 1034] <... open resumed>) = 5 [pid 1034] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1029] <... futex resumed>) = 0 [pid 1034] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1029] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1034] <... mount resumed>) = 0 [pid 1029] <... futex resumed>) = 0 [pid 1034] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1034] <... futex resumed>) = 0 [pid 1029] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1034] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1029] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1034] <... open resumed>) = 6 [pid 1029] <... futex resumed>) = 0 [pid 1034] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1034] <... futex resumed>) = 0 [pid 1029] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1034] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1029] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1034] <... write resumed>) = 8 [pid 1029] <... futex resumed>) = 0 [pid 1034] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1034] <... futex resumed>) = 0 [pid 1029] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1034] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1029] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1034] <... write resumed>) = 1045 [pid 1029] <... futex resumed>) = 0 [pid 1034] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1029] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... openat resumed>) = 4 [pid 1034] <... futex resumed>) = 0 [pid 1033] <... close resumed>) = 0 [pid 1030] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1029] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1022] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(4, "", [pid 1034] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1033] mkdir("./bus", 0777 [pid 1030] <... write resumed>) = 1045 [pid 1022] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1033] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1030] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1022] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1019] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... openat resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./24/bus", [pid 294] getdents64(4, [pid 1033] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1030] <... futex resumed>) = 0 [pid 297] newfstatat(3, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1030] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1019] ioctl(4, LOOP_CLR_FD [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] unlink("./24/bus" [pid 294] getdents64(4, [pid 1019] <... ioctl resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1033] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1019] close(4) = 0 [pid 1033] ioctl(4, LOOP_CLR_FD [pid 1019] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1033] <... ioctl resumed>) = 0 [pid 1019] <... futex resumed>) = 0 [pid 1033] close(4 [pid 1019] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1033] <... close resumed>) = 0 [pid 1033] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1033] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1029] exit_group(0 [pid 1034] <... futex resumed>) = ? [pid 1033] <... futex resumed>) = ? [pid 1029] <... exit_group resumed>) = ? [pid 1034] +++ exited with 0 +++ [pid 1033] +++ exited with 0 +++ [pid 1029] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = 0 [pid 296] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1014] exit_group(0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1029, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] newfstatat(AT_FDCWD, "./24/binderfs", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] close(4 [pid 1024] <... futex resumed>) = ? [pid 1020] <... futex resumed>) = ? [pid 1014] <... exit_group resumed>) = ? [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1020] +++ exited with 0 +++ [pid 296] unlink("./24/binderfs") = 0 [pid 296] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1024] +++ exited with 0 +++ [pid 297] newfstatat(AT_FDCWD, "./24/bus", [pid 296] <... openat resumed>) = 4 [pid 1019] <... futex resumed>) = ? [pid 299] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] newfstatat(4, "", [pid 294] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] unlink("./24/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] close(4 [pid 299] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... close resumed>) = 0 [pid 294] rmdir("./24/file1" [pid 299] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] rmdir("./24/file1" [pid 299] newfstatat(3, "", [pid 297] newfstatat(AT_FDCWD, "./24/binderfs", [pid 296] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] close(3 [pid 299] getdents64(3, [pid 297] unlink("./24/binderfs" [pid 296] <... close resumed>) = 0 [pid 294] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... unlink resumed>) = 0 [pid 296] rmdir("./24" [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... rmdir resumed>) = 0 [pid 294] close(3 [pid 299] <... umount2 resumed>) = 0 [pid 296] mkdir("./25", 0777 [pid 299] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... mkdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 299] newfstatat(AT_FDCWD, "./26/bus", [pid 296] <... openat resumed>) = 3 [pid 294] rmdir("./24" [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 299] unlink("./26/bus" [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... rmdir resumed>) = 0 [pid 296] close(3) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] mkdir("./25", 0777 [pid 299] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1037 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... mkdir resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./26/binderfs", [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./26/binderfs" [pid 294] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] getdents64(3, [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3 [pid 299] close(3 [pid 294] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] rmdir("./26"./strace-static-x86_64: Process 1037 attached ) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1038 [ 30.056853][ T1033] loop5: detected capacity change from 0 to 512 [ 30.065833][ T1019] EXT4-fs (loop4): get root inode failed [ 30.071940][ T1019] EXT4-fs (loop4): mount failed [ 30.080002][ T1033] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 30.087594][ T1027] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1037] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1037] chdir("./25") = 0 [pid 1037] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1037] setpgid(0, 0) = 0 [pid 1037] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1037] write(3, "1000", 4) = 4 [pid 1037] close(3) = 0 [pid 1037] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1037] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 299] mkdir("./27", 0777 [pid 1037] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR./strace-static-x86_64: Process 1038 attached [pid 1037] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1037] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1037] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1037] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1037] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1039]}, 88) = 1039 [pid 1037] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1037] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1037] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1038] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1037] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 1039 attached [pid 1038] chdir("./25" [pid 1039] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1038] <... chdir resumed>) = 0 [pid 1037] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1037] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1027] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1037] <... clone3 resumed> => {parent_tid=[1040]}, 88) = 1040 ./strace-static-x86_64: Process 1040 attached [pid 1039] <... set_robust_list resumed>) = 0 [pid 1038] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1027] ioctl(4, LOOP_CLR_FD [pid 1037] rt_sigprocmask(SIG_SETMASK, [], [pid 1039] rt_sigprocmask(SIG_SETMASK, [], [pid 1038] <... prctl resumed>) = 0 [pid 1037] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1037] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1040] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1039] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1038] setpgid(0, 0 [pid 1027] <... ioctl resumed>) = 0 [pid 1040] <... set_robust_list resumed>) = 0 [pid 1040] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1040] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1019] +++ exited with 0 +++ [pid 1014] +++ exited with 0 +++ [pid 1040] <... open resumed>) = 3 [pid 1040] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1037] <... futex resumed>) = 0 [pid 1037] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1040] <... futex resumed>) = 1 [pid 1040] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1040] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1037] <... futex resumed>) = 0 [pid 1037] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1040] <... futex resumed>) = 1 [pid 1040] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1040] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1037] <... futex resumed>) = 0 [pid 1037] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1040] <... futex resumed>) = 1 [pid 1040] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1040] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1037] <... futex resumed>) = 0 [pid 1037] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1037] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1014, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1038] <... setpgid resumed>) = 0 [pid 1039] memfd_create("syzkaller", 0 [pid 1038] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1039] <... memfd_create resumed>) = 5 [pid 298] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1039] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1038] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1039] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1038] write(3, "1000", 4 [pid 298] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1038] <... write resumed>) = 4 [pid 1038] close(3 [pid 298] <... openat resumed>) = 3 [pid 1038] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 1038] symlink("/dev/binderfs", "./binderfs" [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1040] <... futex resumed>) = 1 [pid 298] getdents64(3, [pid 1040] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1038] <... symlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1040] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1038] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1038] <... futex resumed>) = 0 [pid 1040] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1038] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... umount2 resumed>) = 0 [pid 1040] <... futex resumed>) = 1 [pid 1038] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1037] <... futex resumed>) = 0 [pid 298] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1040] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1039] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1038] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1027] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1038] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1027] <... close resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./23/bus", [pid 1038] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1027] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1038] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1027] <... futex resumed>) = 0 [pid 298] unlink("./23/bus" [pid 1038] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... unlink resumed>) = 0 [pid 1038] <... mprotect resumed>) = 0 [pid 298] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1027] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1038] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1038] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1039] <... write resumed>) = 262144 [pid 1038] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] newfstatat(AT_FDCWD, "./23/binderfs", [pid 1022] exit_group(0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1039] munmap(0x7f0c41dcd000, 138412032 [pid 1038] <... clone3 resumed> => {parent_tid=[1041]}, 88) = 1041 [pid 1030] <... futex resumed>) = ? [pid 1027] <... futex resumed>) = ? [pid 1022] <... exit_group resumed>) = ? [pid 298] unlink("./23/binderfs" [pid 1039] <... munmap resumed>) = 0 [pid 1038] rt_sigprocmask(SIG_SETMASK, [], [pid 1030] +++ exited with 0 +++ [pid 1038] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 1041 attached [pid 1038] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 1038] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 1038] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 1041] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 1041] memfd_create("syzkaller", 0) = 3 [pid 297] <... umount2 resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] rmdir("./23" [pid 1039] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1038] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1039] <... openat resumed>) = 6 [pid 1038] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] close(3 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1039] ioctl(6, LOOP_SET_FD, 5 [pid 1038] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... close resumed>) = 0 [pid 298] mkdir("./24", 0777 [pid 297] newfstatat(AT_FDCWD, "./24/file1", [pid 1038] <... mprotect resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... mkdir resumed>) = 0 [pid 1041] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1038] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1042 [pid 298] <... openat resumed>) = 3 [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1041] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1041] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1041] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1041] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 1041] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1042 attached [pid 1039] <... ioctl resumed>) = 0 [pid 1038] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1042] set_robust_list(0x555556d8d6a0, 24 [pid 1038] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1042] <... set_robust_list resumed>) = 0 [pid 298] close(3 [pid 297] <... openat resumed>) = 4 [pid 1042] chdir("./27" [pid 1038] <... clone3 resumed> => {parent_tid=[1043]}, 88) = 1043 [pid 298] <... close resumed>) = 0 [pid 297] newfstatat(4, "", [pid 1042] <... chdir resumed>) = 0 [pid 1038] rt_sigprocmask(SIG_SETMASK, [], [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1042] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1038] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] getdents64(4, [pid 1042] <... prctl resumed>) = 0 [pid 1038] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1044 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1042] setpgid(0, 0 [pid 1038] <... futex resumed>) = 0 [pid 297] getdents64(4, [pid 1042] <... setpgid resumed>) = 0 [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1042] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] close(4 [pid 1042] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 1042] write(3, "1000", 4 [pid 297] rmdir("./24/file1"./strace-static-x86_64: Process 1043 attached [pid 1042] <... write resumed>) = 4 [pid 1041] <... ioctl resumed>) = 0 [pid 1039] close(5 [pid 297] <... rmdir resumed>) = 0 [pid 1042] close(3 [pid 297] getdents64(3, [pid 1042] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1042] symlink("/dev/binderfs", "./binderfs" [pid 297] close(3./strace-static-x86_64: Process 1044 attached [pid 1043] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1042] <... symlink resumed>) = 0 [pid 1041] close(3 [pid 1039] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 1042] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] rmdir("./24" [pid 1044] set_robust_list(0x555556d8d6a0, 24 [pid 1043] <... set_robust_list resumed>) = 0 [pid 1042] <... futex resumed>) = 0 [pid 1041] <... close resumed>) = 0 [pid 1039] mkdir("./file1", 0777 [pid 297] <... rmdir resumed>) = 0 [pid 1042] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 297] mkdir("./25", 0777 [pid 1042] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1041] mkdir("./file1", 0777 [pid 1039] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 1042] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1042] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... openat resumed>) = 3 [pid 1042] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 1042] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1042] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] close(3 [pid 1042] <... mprotect resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 1042] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1042] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1042] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1045 [pid 1043] rt_sigprocmask(SIG_SETMASK, [], [pid 1044] <... set_robust_list resumed>) = 0 [pid 1041] <... mkdir resumed>) = 0 [pid 1039] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1046 attached ./strace-static-x86_64: Process 1045 attached [pid 1042] <... clone3 resumed> => {parent_tid=[1046]}, 88) = 1046 [pid 1042] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1042] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1043] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1042] <... futex resumed>) = 0 [pid 1041] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1042] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1042] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1043] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1042] <... mprotect resumed>) = 0 [pid 1043] <... open resumed>) = 3 [pid 1042] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1043] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1042] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1043] <... futex resumed>) = 1 [pid 1042] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1038] <... futex resumed>) = 0 [pid 1044] chdir("./24" [pid 1043] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1038] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1042] <... clone3 resumed> => {parent_tid=[1047]}, 88) = 1047 [pid 1038] <... futex resumed>) = 0 [pid 1042] rt_sigprocmask(SIG_SETMASK, [], [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1042] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1043] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1042] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1047 attached [pid 1047] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1047] rt_sigprocmask(SIG_SETMASK, [], [pid 1043] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1044] <... chdir resumed>) = 0 [pid 1047] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1044] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1043] <... mount resumed>) = 0 [pid 1044] <... prctl resumed>) = 0 [pid 1043] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1038] <... futex resumed>) = 0 [pid 1044] setpgid(0, 0 [pid 1045] set_robust_list(0x555556d8d6a0, 24 [pid 1038] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1044] <... setpgid resumed>) = 0 [pid 1043] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1047] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1044] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1043] <... open resumed>) = 5 [pid 1043] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1044] <... openat resumed>) = 3 [pid 1043] <... futex resumed>) = 1 [pid 1038] <... futex resumed>) = 0 [pid 1044] write(3, "1000", 4 [pid 1043] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1038] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1045] <... set_robust_list resumed>) = 0 [pid 1047] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1046] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1044] <... write resumed>) = 4 [pid 1043] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1038] <... futex resumed>) = 0 [pid 1044] close(3 [pid 1043] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1044] <... close resumed>) = 0 [pid 1043] <... write resumed>) = 8 [pid 1044] symlink("/dev/binderfs", "./binderfs" [pid 1043] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1038] <... futex resumed>) = 0 [pid 1038] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1038] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1045] chdir("./25") = 0 [pid 1043] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1044] <... symlink resumed>) = 0 [pid 1045] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1044] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1045] <... prctl resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1043] <... write resumed>) = 1045 [pid 1045] setpgid(0, 0 [pid 1044] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1043] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1046] <... set_robust_list resumed>) = 0 [pid 1045] <... setpgid resumed>) = 0 [pid 1045] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1044] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1043] <... futex resumed>) = 1 [pid 1038] <... futex resumed>) = 0 [pid 1047] <... futex resumed>) = 1 [pid 1046] rt_sigprocmask(SIG_SETMASK, [], [pid 1045] <... openat resumed>) = 3 [pid 1044] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1043] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1042] <... futex resumed>) = 0 [pid 1045] write(3, "1000", 4 [pid 1042] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1045] <... write resumed>) = 4 [pid 1042] <... futex resumed>) = 0 [pid 1045] close(3 [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1045] <... close resumed>) = 0 [ 30.117738][ T1027] EXT4-fs (loop1): get root inode failed [ 30.124321][ T1027] EXT4-fs (loop1): mount failed [ 30.153750][ T1039] loop2: detected capacity change from 0 to 512 [ 30.160040][ T1041] loop0: detected capacity change from 0 to 512 [pid 1044] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1046] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1047] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1045] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1044] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1045] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1044] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1045] <... futex resumed>) = 0 [pid 1044] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1045] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1044] <... mprotect resumed>) = 0 [pid 1045] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1045] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1044] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1045] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1044] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1045] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1044] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1045] <... clone3 resumed> => {parent_tid=[1052]}, 88) = 1052 [pid 1045] rt_sigprocmask(SIG_SETMASK, [], [pid 1044] <... clone3 resumed> => {parent_tid=[1053]}, 88) = 1053 [pid 1046] memfd_create("syzkaller", 0 [pid 1045] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1044] rt_sigprocmask(SIG_SETMASK, [], [pid 1045] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1045] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1045] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1045] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1054]}, 88) = 1054 [pid 1045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1045] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1045] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1053 attached [pid 1053] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1053] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1053] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1052 attached [pid 1052] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1052] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1052] memfd_create("syzkaller", 0) = 3 [pid 1052] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1044] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1027] +++ exited with 0 +++ [pid 1022] +++ exited with 0 +++ [pid 1044] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1022, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 1044] <... futex resumed>) = 1 [pid 1046] <... memfd_create resumed>) = 4 [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1047] <... mount resumed>) = 0 [pid 1046] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1044] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1044] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1044] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 295] <... openat resumed>) = 3 [pid 295] newfstatat(3, "", [pid 1044] <... mprotect resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1044] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] getdents64(3, [pid 1044] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1044] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1053] <... futex resumed>) = 0 [pid 1047] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1046] <... mmap resumed>) = 0x7f0c41dcd000 [pid 295] <... umount2 resumed>) = 0 [pid 1044] <... clone3 resumed> => {parent_tid=[1055]}, 88) = 1055 [pid 295] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1044] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1044] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] newfstatat(AT_FDCWD, "./23/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./23/bus") = 0 [pid 295] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./23/binderfs") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./23") = 0 [pid 295] mkdir("./24", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 1044] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1053] memfd_create("syzkaller", 0 [pid 1044] <... futex resumed>) = 0 [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1056 [pid 1053] <... memfd_create resumed>) = 3 [pid 1047] <... futex resumed>) = 1 [pid 1046] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1042] <... futex resumed>) = 0 [pid 1042] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1053] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1047] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1053] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1052] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1047] <... open resumed>) = 5 [pid 1046] <... write resumed>) = 262144 [pid 1047] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1053] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1047] <... futex resumed>) = 1 [pid 1046] munmap(0x7f0c41dcd000, 138412032 [pid 1042] <... futex resumed>) = 0 [pid 1047] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 1042] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1047] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1042] <... futex resumed>) = 0 [pid 1047] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1047] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1042] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1047] <... futex resumed>) = 0 [pid 1042] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1047] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1042] <... futex resumed>) = 0 [pid 1047] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1042] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1047] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1042] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1047] <... futex resumed>) = 0 [pid 1047] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1052] <... write resumed>) = 262144 [pid 1053] <... write resumed>) = 262144 [pid 1046] <... munmap resumed>) = 0 ./strace-static-x86_64: Process 1054 attached ./strace-static-x86_64: Process 1055 attached [pid 1055] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1053] munmap(0x7f0c41dcd000, 138412032 [pid 1054] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1046] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1041] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1052] munmap(0x7f0c41dcd000, 138412032 [pid 1055] <... set_robust_list resumed>) = 0 [pid 1055] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1055] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1055] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1055] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1056 attached [pid 1056] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1056] chdir("./24") = 0 [pid 1056] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1056] setpgid(0, 0) = 0 [ 30.184038][ T1041] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.202289][ T1039] EXT4-fs (loop2): 1 orphan inode deleted [ 30.211939][ T1041] EXT4-fs (loop0): get root inode failed [ 30.218487][ T1041] EXT4-fs (loop0): mount failed [pid 1056] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1056] write(3, "1000", 4) = 4 [pid 1056] close(3 [pid 1045] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1045] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c41dac000 [pid 1045] mprotect(0x7f0c41dad000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1045] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41dcc990, parent_tid=0x7f0c41dcc990, exit_signal=0, stack=0x7f0c41dac000, stack_size=0x20300, tls=0x7f0c41dcc6c0} => {parent_tid=[1057]}, 88) = 1057 [pid 1045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1045] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1045] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1056] <... close resumed>) = 0 [pid 1056] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1056] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1056] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1044] <... futex resumed>) = 0 [pid 1046] <... openat resumed>) = 6 [pid 1044] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1041] ioctl(4, LOOP_CLR_FD [pid 1055] <... futex resumed>) = 0 [pid 1053] <... munmap resumed>) = 0 [pid 1044] <... futex resumed>) = 1 [pid 1041] <... ioctl resumed>) = 0 [pid 1046] ioctl(6, LOOP_SET_FD, 4 [pid 1054] <... set_robust_list resumed>) = 0 [pid 1055] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1053] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1052] <... munmap resumed>) = 0 [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1041] close(4 [pid 1056] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1056] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1056] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1056] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1056] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1056] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1058]}, 88) = 1058 [pid 1056] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1056] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1056] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1056] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1056] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1056] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1055] <... mount resumed>) = 0 [pid 1054] rt_sigprocmask(SIG_SETMASK, [], [pid 1053] <... openat resumed>) = 5 [pid 1052] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1041] <... close resumed>) = 0 [pid 1055] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1054] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1053] ioctl(5, LOOP_SET_FD, 3 [pid 1052] <... openat resumed>) = 4 [pid 1041] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1038] exit_group(0./strace-static-x86_64: Process 1057 attached [pid 1056] <... clone3 resumed> => {parent_tid=[1059]}, 88) = 1059 [pid 1055] <... futex resumed>) = 1 [pid 1054] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1044] <... futex resumed>) = 0 [pid 1043] <... futex resumed>) = ? [pid 1038] <... exit_group resumed>) = ? [pid 1056] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1056] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1058 attached [pid 1058] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1058] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1058] memfd_create("syzkaller", 0) = 3 [pid 1058] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1044] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1055] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1044] <... futex resumed>) = 0 [pid 1043] +++ exited with 0 +++ [pid 1041] <... futex resumed>) = ? [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1054] <... open resumed>) = 5 [pid 1039] <... mount resumed>) = 0 [pid 1057] set_robust_list(0x7f0c41dcc9a0, 24 [pid 1054] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1052] ioctl(4, LOOP_SET_FD, 3 [pid 1057] <... set_robust_list resumed>) = 0 [pid 1054] <... futex resumed>) = 0 [pid 1039] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 1039] chdir("./file1") = 0 [pid 1039] ioctl(6, LOOP_CLR_FD) = 0 [pid 1039] close(6) = 0 [pid 1039] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1039] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1046] <... ioctl resumed>) = 0 [pid 1046] close(4) = 0 [pid 1046] mkdir("./file1", 0777) = 0 [pid 1046] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1059 attached [pid 1059] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1059] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1059] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1037] exit_group(0) = ? [pid 1040] <... futex resumed>) = ? [pid 1040] +++ exited with 0 +++ [pid 1039] <... futex resumed>) = ? [pid 1059] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1039] +++ exited with 0 +++ [pid 1037] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1037, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 1056] <... futex resumed>) = 0 [pid 1056] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... restart_syscall resumed>) = 0 [pid 1056] <... futex resumed>) = 0 [pid 1054] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1057] rt_sigprocmask(SIG_SETMASK, [], [pid 296] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1057] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... openat resumed>) = 3 [pid 1057] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 1057] <... mount resumed>) = 0 [pid 1057] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1057] <... futex resumed>) = 1 [pid 1045] <... futex resumed>) = 0 [pid 296] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1058] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1057] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1045] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 1054] <... futex resumed>) = 0 [pid 1045] <... futex resumed>) = 1 [pid 296] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1054] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1045] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./25/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./25/bus") = 0 [pid 296] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./25/binderfs") = 0 [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1059] <... futex resumed>) = 1 [pid 1059] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1059] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1056] <... futex resumed>) = 0 [pid 1056] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1058] <... write resumed>) = 262144 [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1058] munmap(0x7f0c41dcd000, 138412032 [pid 1059] <... futex resumed>) = 1 [pid 1058] <... munmap resumed>) = 0 [ 30.229154][ T1039] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/25/file1 supports timestamps until 2038 (0x7fffffff) [ 30.242553][ T1046] loop5: detected capacity change from 0 to 512 [ 30.251059][ T1053] loop4: detected capacity change from 0 to 512 [ 30.259401][ T1052] loop3: detected capacity change from 0 to 512 [pid 1059] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1058] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1055] <... open resumed>) = 6 [pid 1054] <... open resumed>) = 6 [pid 1053] <... ioctl resumed>) = 0 [pid 1052] <... ioctl resumed>) = 0 [pid 1058] <... openat resumed>) = 5 [pid 1055] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1054] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1053] close(3 [pid 1052] close(3 [pid 1058] ioctl(5, LOOP_SET_FD, 3 [pid 1055] <... futex resumed>) = 1 [pid 1054] <... futex resumed>) = 1 [pid 1053] <... close resumed>) = 0 [pid 1052] <... close resumed>) = 0 [pid 1045] <... futex resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1055] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1054] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1053] mkdir("./bus", 0777 [pid 1052] mkdir("./bus", 0777 [pid 1045] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1044] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1055] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1054] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1053] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1052] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1045] <... futex resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1055] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1054] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1053] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1052] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1045] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1055] <... write resumed>) = 8 [pid 1054] <... write resumed>) = 8 [pid 1055] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1054] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1055] <... futex resumed>) = 1 [pid 1054] <... futex resumed>) = 1 [pid 1045] <... futex resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1055] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1054] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1045] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1044] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1055] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1054] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1045] <... futex resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1055] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1054] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1045] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1044] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1055] <... write resumed>) = 1045 [pid 1054] <... write resumed>) = 1045 [pid 1055] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1054] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1055] <... futex resumed>) = 1 [pid 1054] <... futex resumed>) = 1 [pid 1045] <... futex resumed>) = 0 [pid 1044] <... futex resumed>) = 0 [pid 1055] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1054] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1059] <... open resumed>) = 6 [pid 1059] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1056] <... futex resumed>) = 0 [pid 1059] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1056] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1059] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1056] <... futex resumed>) = 0 [pid 1059] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1059] <... write resumed>) = 8 [pid 1058] <... ioctl resumed>) = 0 [pid 1059] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1058] close(3 [pid 1059] <... futex resumed>) = 1 [pid 1058] <... close resumed>) = 0 [pid 1056] <... futex resumed>) = 0 [pid 1059] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1058] mkdir("./bus", 0777 [pid 1056] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1059] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1058] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1056] <... futex resumed>) = 0 [pid 1059] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1058] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1056] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1059] <... write resumed>) = 1045 [pid 1046] <... mount resumed>) = 0 [pid 1046] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 1046] chdir("./file1") = 0 [pid 1046] ioctl(6, LOOP_CLR_FD) = 0 [pid 1046] close(6) = 0 [pid 1046] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1046] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1059] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1056] <... futex resumed>) = 0 [pid 1059] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1042] exit_group(0 [pid 1046] <... futex resumed>) = ? [pid 1042] <... exit_group resumed>) = ? [pid 1046] +++ exited with 0 +++ [pid 1047] <... futex resumed>) = ? [pid 1047] +++ exited with 0 +++ [pid 1042] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1042, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 1058] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(3, "", [pid 1058] ioctl(5, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1058] <... ioctl resumed>) = 0 [pid 1058] close(5) = 0 [pid 1058] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1058] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1056] exit_group(0 [pid 1059] <... futex resumed>) = ? [pid 1058] <... futex resumed>) = ? [pid 1056] <... exit_group resumed>) = ? [pid 1059] +++ exited with 0 +++ [pid 1058] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./25/file1") = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./25") = 0 [pid 296] mkdir("./26", 0777) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 299] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] ioctl(3, LOOP_CLR_FD [pid 299] newfstatat(AT_FDCWD, "./27/bus", [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1041] +++ exited with 0 +++ [pid 1038] +++ exited with 0 +++ [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] close(3 [pid 299] unlink("./27/bus" [pid 296] <... close resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1038, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] <... unlink resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 299] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... restart_syscall resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1065 [pid 299] newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./27/binderfs" [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 294] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... openat resumed>) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 294] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./25/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./25/bus") = 0 [pid 294] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./25/binderfs") = 0 [pid 294] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 30.282285][ T1058] loop1: detected capacity change from 0 to 512 [ 30.287389][ T1046] EXT4-fs (loop5): 1 orphan inode deleted [ 30.294756][ T1046] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/27/file1 supports timestamps until 2038 (0x7fffffff) [ 30.305412][ T1058] EXT4-fs (loop1): Invalid log block size: 2475723007 [ 30.314167][ T1053] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./25/file1") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./25") = 0 [pid 294] mkdir("./26", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1067 ./strace-static-x86_64: Process 1067 attached ./strace-static-x86_64: Process 1065 attached [pid 1056] +++ exited with 0 +++ [pid 1067] set_robust_list(0x555556d8d6a0, 24 [pid 1065] set_robust_list(0x555556d8d6a0, 24 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1056, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1067] <... set_robust_list resumed>) = 0 [pid 1067] chdir("./26") = 0 [pid 1067] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1067] setpgid(0, 0) = 0 [pid 1067] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1067] write(3, "1000", 4) = 4 [pid 1067] close(3) = 0 [pid 1067] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1067] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1067] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1067] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1067] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1067] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1067] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1067] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1068]}, 88) = 1068 [pid 1067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1065] <... set_robust_list resumed>) = 0 [pid 1067] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1067] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1067] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1067] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 299] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 1068 attached [pid 1068] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1068] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1068] memfd_create("syzkaller", 0) = 3 [pid 1068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1068] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1068] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 1068] ioctl(4, LOOP_SET_FD, 3 [pid 1065] chdir("./26" [pid 1067] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1065] <... chdir resumed>) = 0 [pid 1053] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1052] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1065] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1053] ioctl(5, LOOP_CLR_FD [pid 1052] ioctl(4, LOOP_CLR_FD [pid 1065] <... prctl resumed>) = 0 [pid 1053] <... ioctl resumed>) = 0 [pid 1052] <... ioctl resumed>) = 0 [pid 1065] setpgid(0, 0 [pid 1053] close(5 [pid 1052] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1067] <... clone3 resumed> => {parent_tid=[1069]}, 88) = 1069 [pid 299] newfstatat(AT_FDCWD, "./27/file1", [pid 1067] rt_sigprocmask(SIG_SETMASK, [], [pid 295] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1067] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... openat resumed>) = 3 [pid 1067] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1065] <... setpgid resumed>) = 0 [pid 1053] <... close resumed>) = 0 [pid 1052] <... close resumed>) = 0 [pid 299] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(3, "", [pid 1067] <... futex resumed>) = 0 [pid 1065] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1053] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1052] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1065] <... openat resumed>) = 3 [pid 1053] <... futex resumed>) = 0 [pid 1052] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1044] exit_group(0 [pid 299] <... openat resumed>) = 4 [pid 1065] write(3, "1000", 4 [pid 1052] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1045] exit_group(0 [pid 1044] <... exit_group resumed>) = ? [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1055] <... futex resumed>) = 104 [pid 1057] <... futex resumed>) = ? [pid 1054] <... futex resumed>) = ? [pid 1045] <... exit_group resumed>) = ? [pid 299] newfstatat(4, "", [pid 1057] +++ exited with 0 +++ [pid 1054] +++ exited with 0 +++ [pid 1065] <... write resumed>) = 4 [pid 1055] +++ exited with 0 +++ [pid 1052] <... futex resumed>) = ? [pid 1065] close(3 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1065] <... close resumed>) = 0 [pid 299] getdents64(4, [pid 1065] symlink("/dev/binderfs", "./binderfs") = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] <... umount2 resumed>) = 0 [pid 1065] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 295] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1065] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1065] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 299] close(4 [pid 295] newfstatat(AT_FDCWD, "./24/bus", [pid 1065] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... close resumed>) = 0 [pid 1065] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1065] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] rmdir("./27/file1" [pid 295] unlink("./24/bus" [pid 1065] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1065] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1065] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1065] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... rmdir resumed>) = 0 [pid 295] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1065] <... clone3 resumed> => {parent_tid=[1070]}, 88) = 1070 [pid 299] getdents64(3, [pid 1065] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1065] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] newfstatat(AT_FDCWD, "./24/binderfs", [pid 1065] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 1065] <... futex resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 1065] <... futex resumed>) = 0 [pid 299] rmdir("./27" [pid 295] unlink("./24/binderfs" [pid 1065] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1065] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1065] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1065] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... rmdir resumed>) = 0 [pid 1065] <... clone3 resumed> => {parent_tid=[1071]}, 88) = 1071 [pid 1065] rt_sigprocmask(SIG_SETMASK, [], [pid 299] mkdir("./28", 0777 [pid 295] <... unlink resumed>) = 0 [pid 1065] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1065] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1071 attached ./strace-static-x86_64: Process 1070 attached ./strace-static-x86_64: Process 1069 attached [ 30.343416][ T1052] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.352081][ T1053] EXT4-fs (loop4): get root inode failed [ 30.359249][ T1052] EXT4-fs (loop3): get root inode failed [ 30.363717][ T1053] EXT4-fs (loop4): mount failed [ 30.367723][ T1052] EXT4-fs (loop3): mount failed [pid 299] <... mkdir resumed>) = 0 [pid 295] getdents64(3, [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... openat resumed>) = 3 [pid 295] close(3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 295] <... close resumed>) = 0 [pid 1071] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1070] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1069] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1068] <... ioctl resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] rmdir("./24" [pid 1071] <... set_robust_list resumed>) = 0 [pid 1070] <... set_robust_list resumed>) = 0 [pid 1069] <... set_robust_list resumed>) = 0 [pid 1068] close(3 [pid 299] close(3 [pid 1071] rt_sigprocmask(SIG_SETMASK, [], [pid 1070] rt_sigprocmask(SIG_SETMASK, [], [pid 1069] rt_sigprocmask(SIG_SETMASK, [], [pid 1068] <... close resumed>) = 0 [pid 1071] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1070] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1069] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1068] mkdir("./file1", 0777 [pid 295] <... rmdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 295] mkdir("./25", 0777 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1071] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1070] memfd_create("syzkaller", 0 [pid 1069] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1068] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 1071] <... open resumed>) = 4 [pid 1070] <... memfd_create resumed>) = 3 [pid 1069] <... open resumed>) = 3 [pid 1068] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1072 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1071] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1069] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 1071] <... futex resumed>) = 1 [pid 1070] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1069] <... futex resumed>) = 1 [pid 1067] <... futex resumed>) = 0 [pid 1065] <... futex resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 1071] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1069] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1067] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1065] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1071] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1070] <... write resumed>) = 262144 [pid 1069] <... mount resumed>) = 0 [pid 1067] <... futex resumed>) = 0 [pid 1065] <... futex resumed>) = 0 [pid 295] close(3 [pid 1071] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1070] munmap(0x7f0c41dcd000, 138412032 [pid 1069] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... close resumed>) = 0 [pid 1071] <... futex resumed>) = 0 [pid 1070] <... munmap resumed>) = 0 [pid 1069] <... futex resumed>) = 0 [pid 1067] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1065] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1071] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1070] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1069] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1067] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1065] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1071] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1070] <... openat resumed>) = 5 [pid 1069] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1065] <... futex resumed>) = 0 [pid 1071] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1070] ioctl(5, LOOP_SET_FD, 3 [pid 1069] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1067] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1073 attached ./strace-static-x86_64: Process 1072 attached [pid 1071] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1070] <... ioctl resumed>) = 0 [pid 1069] <... open resumed>) = 5 [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1073 [pid 1073] set_robust_list(0x555556d8d6a0, 24 [pid 1072] set_robust_list(0x555556d8d6a0, 24 [pid 1071] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1070] close(3 [pid 1069] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] <... set_robust_list resumed>) = 0 [pid 1072] <... set_robust_list resumed>) = 0 [pid 1073] chdir("./25" [pid 1072] chdir("./28" [pid 1071] <... futex resumed>) = 1 [pid 1069] <... futex resumed>) = 1 [pid 1067] <... futex resumed>) = 0 [pid 1065] <... futex resumed>) = 0 [pid 1073] <... chdir resumed>) = 0 [pid 1072] <... chdir resumed>) = 0 [pid 1070] <... close resumed>) = 0 [pid 1067] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1072] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1067] <... futex resumed>) = 0 [pid 1073] <... prctl resumed>) = 0 [pid 1072] <... prctl resumed>) = 0 [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1073] setpgid(0, 0 [pid 1072] setpgid(0, 0 [pid 1071] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1069] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1065] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] <... setpgid resumed>) = 0 [pid 1072] <... setpgid resumed>) = 0 [pid 1073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1073] <... openat resumed>) = 3 [pid 1072] <... openat resumed>) = 3 [pid 1073] write(3, "1000", 4 [pid 1072] write(3, "1000", 4 [pid 1073] <... write resumed>) = 4 [pid 1072] <... write resumed>) = 4 [pid 1073] close(3 [pid 1072] close(3 [pid 1073] <... close resumed>) = 0 [pid 1072] <... close resumed>) = 0 [pid 1073] symlink("/dev/binderfs", "./binderfs" [pid 1072] symlink("/dev/binderfs", "./binderfs" [pid 1073] <... symlink resumed>) = 0 [pid 1072] <... symlink resumed>) = 0 [pid 1073] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1072] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] <... futex resumed>) = 0 [pid 1072] <... futex resumed>) = 0 [pid 1073] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1072] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1073] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1072] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1073] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1072] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1073] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1073] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1072] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1073] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1072] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1073] <... mprotect resumed>) = 0 [pid 1072] <... mprotect resumed>) = 0 [pid 1073] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1072] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1071] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1070] mkdir("./file1", 0777 [pid 1069] <... write resumed>) = 8 [pid 1065] <... futex resumed>) = 0 [pid 1073] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1072] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1071] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1070] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1069] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1053] +++ exited with 0 +++ [pid 1052] +++ exited with 0 +++ [pid 1045] +++ exited with 0 +++ [pid 1044] +++ exited with 0 +++ [pid 1073] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1071] <... futex resumed>) = 0 [pid 1070] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1069] <... futex resumed>) = 1 [pid 1067] <... futex resumed>) = 0 [pid 1065] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 1077 attached ./strace-static-x86_64: Process 1076 attached [pid 1071] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1077] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1076] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1077] <... set_robust_list resumed>) = 0 [pid 1076] <... set_robust_list resumed>) = 0 [pid 1069] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1067] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1065] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1044, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1045, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1077] rt_sigprocmask(SIG_SETMASK, [], [pid 1076] rt_sigprocmask(SIG_SETMASK, [], [pid 1071] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1077] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1076] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1071] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1069] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1067] <... futex resumed>) = 0 [pid 1065] <... futex resumed>) = 0 [pid 298] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1077] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1076] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1069] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1067] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1065] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1071] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1073] <... clone3 resumed> => {parent_tid=[1076]}, 88) = 1076 [pid 1072] <... clone3 resumed> => {parent_tid=[1077]}, 88) = 1077 [pid 1071] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1071] <... futex resumed>) = 1 [pid 1065] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 1072] rt_sigprocmask(SIG_SETMASK, [], [pid 1071] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1069] <... write resumed>) = 1045 [pid 1073] rt_sigprocmask(SIG_SETMASK, [], [pid 298] newfstatat(3, "", [pid 297] <... openat resumed>) = 3 [pid 1073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1069] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] newfstatat(3, "", [pid 1073] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1072] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1069] <... futex resumed>) = 1 [pid 1067] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 1073] <... futex resumed>) = 1 [pid 1072] <... futex resumed>) = 1 [pid 1069] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1077] <... futex resumed>) = 0 [pid 1076] <... futex resumed>) = 0 [pid 1072] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1073] <... futex resumed>) = 0 [pid 298] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1073] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1077] memfd_create("syzkaller", 0 [pid 1076] memfd_create("syzkaller", 0 [pid 297] <... umount2 resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./24/bus", [pid 1073] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1072] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1077] <... memfd_create resumed>) = 3 [pid 1076] <... memfd_create resumed>) = 3 [pid 1072] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1077] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1076] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1073] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1072] <... mprotect resumed>) = 0 [pid 298] unlink("./24/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1077] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1076] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1073] <... mprotect resumed>) = 0 [pid 1072] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] newfstatat(AT_FDCWD, "./25/bus", [pid 298] <... unlink resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1073] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1072] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./25/bus" [pid 1072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./24/binderfs", [pid 297] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1072] <... clone3 resumed> => {parent_tid=[1079]}, 88) = 1079 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./24/binderfs" [pid 1072] rt_sigprocmask(SIG_SETMASK, [], [pid 297] newfstatat(AT_FDCWD, "./25/binderfs", [pid 1077] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1076] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1073] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1072] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 297] unlink("./25/binderfs" [pid 1072] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 297] <... unlink resumed>) = 0 [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 298] rmdir("./24" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] close(3 [pid 1073] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] mkdir("./25", 0777 [pid 297] <... close resumed>) = 0 [pid 1068] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] rmdir("./25" [pid 1068] ioctl(4, LOOP_CLR_FD [pid 298] <... mkdir resumed>) = 0 [pid 1073] <... clone3 resumed> => {parent_tid=[1080]}, 88) = 1080 [pid 1068] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... rmdir resumed>) = 0 [pid 1073] rt_sigprocmask(SIG_SETMASK, [], [pid 1068] close(4 [pid 298] <... openat resumed>) = 3 [pid 297] mkdir("./26", 0777 [pid 1073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1068] <... close resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1073] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1073] <... futex resumed>) = 0 [pid 298] close(3 [pid 297] <... openat resumed>) = 3 [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1068] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1081 attached ./strace-static-x86_64: Process 1080 attached ./strace-static-x86_64: Process 1079 attached [pid 1077] <... write resumed>) = 262144 [pid 1076] <... write resumed>) = 262144 [pid 1068] <... futex resumed>) = 0 [pid 297] close(3 [pid 1081] set_robust_list(0x555556d8d6a0, 24 [pid 1080] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1079] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1077] munmap(0x7f0c41dcd000, 138412032 [pid 1076] munmap(0x7f0c41dcd000, 138412032 [pid 1067] exit_group(0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1081 [pid 297] <... close resumed>) = 0 [pid 1081] <... set_robust_list resumed>) = 0 [pid 1080] <... set_robust_list resumed>) = 0 [pid 1079] <... set_robust_list resumed>) = 0 [pid 1081] chdir("./25" [pid 1080] rt_sigprocmask(SIG_SETMASK, [], [pid 1079] rt_sigprocmask(SIG_SETMASK, [], [pid 1077] <... munmap resumed>) = 0 [pid 1076] <... munmap resumed>) = 0 [pid 1069] <... futex resumed>) = ? [pid 1067] <... exit_group resumed>) = ? [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1081] <... chdir resumed>) = 0 [pid 1068] +++ exited with 0 +++ [pid 1080] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1079] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1077] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1076] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1069] +++ exited with 0 +++ [pid 1081] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1079] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1076] <... openat resumed>) = 4 [pid 1077] <... openat resumed>) = 4 [pid 1080] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1081] <... prctl resumed>) = 0 [pid 1079] <... open resumed>) = 5 [pid 1077] ioctl(4, LOOP_SET_FD, 3 [pid 1076] ioctl(4, LOOP_SET_FD, 3 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1083 [pid 1080] <... open resumed>) = 5 [pid 1081] setpgid(0, 0 [pid 1080] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1079] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] <... setpgid resumed>) = 0 [ 30.390864][ T1068] loop0: detected capacity change from 0 to 512 [ 30.404870][ T1070] loop2: detected capacity change from 0 to 512 [ 30.414407][ T1068] EXT4-fs (loop0): 1 orphan inode deleted [ 30.422300][ T1068] ext4 filesystem being mounted at /root/syzkaller.iF59aB/26/bus supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 1083 attached [pid 1083] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1083] chdir("./26") = 0 [pid 1083] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1083] setpgid(0, 0) = 0 [pid 1083] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1083] write(3, "1000", 4) = 4 [pid 1083] close(3) = 0 [pid 1083] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1083] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1083] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1083] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1083] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1083] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1083] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1083] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1084]}, 88) = 1084 [pid 1083] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1083] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1083] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1083] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1083] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1085]}, 88) = 1085 [pid 1083] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1083] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1084 attached [pid 1084] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1084] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1084] memfd_create("syzkaller", 0) = 3 [pid 1084] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1084] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1076] <... ioctl resumed>) = 0 [pid 1081] <... openat resumed>) = 3 [pid 1080] <... futex resumed>) = 1 [pid 1073] <... futex resumed>) = 0 [pid 1079] <... futex resumed>) = 1 [pid 1072] <... futex resumed>) = 0 [pid 1073] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1072] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1080] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1073] <... futex resumed>) = 0 [pid 1072] <... futex resumed>) = 0 [pid 1081] write(3, "1000", 4 [pid 1079] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1080] <... mount resumed>) = 0 [pid 1081] <... write resumed>) = 4 [pid 1079] <... mount resumed>) = 0 [pid 1081] close(3 [pid 1080] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1084] <... write resumed>) = 262144 [pid 1084] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1084] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 1084] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 1084] close(3) = 0 [pid 1084] mkdir("./file1", 0777) = 0 [pid 1084] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1077] <... ioctl resumed>) = 0 [pid 1077] close(3) = 0 [pid 1077] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1077] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1085 attached [pid 1085] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1085] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1085] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1085] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1083] <... futex resumed>) = 0 [pid 1083] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1085] <... futex resumed>) = 1 [pid 1085] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1085] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1083] <... futex resumed>) = 0 [pid 1083] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1085] <... futex resumed>) = 1 [pid 1085] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1085] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1083] <... futex resumed>) = 0 [pid 1083] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1081] <... close resumed>) = 0 [pid 1080] <... futex resumed>) = 1 [pid 1079] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] <... futex resumed>) = 0 [pid 1085] <... futex resumed>) = 1 [pid 1073] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] symlink("/dev/binderfs", "./binderfs" [pid 1080] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1079] <... futex resumed>) = 1 [pid 1073] <... futex resumed>) = 0 [pid 1072] <... futex resumed>) = 0 [pid 1085] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1081] <... symlink resumed>) = 0 [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1072] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1076] close(3 [pid 1080] <... open resumed>) = 6 [pid 1072] <... futex resumed>) = 0 [pid 1079] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1081] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1079] <... open resumed>) = 3 [pid 1076] <... close resumed>) = 0 [pid 1076] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1076] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1085] <... write resumed>) = 8 [pid 1080] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1085] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] <... futex resumed>) = 0 [pid 1079] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1085] <... futex resumed>) = 1 [pid 1083] <... futex resumed>) = 0 [pid 1081] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1079] <... futex resumed>) = 1 [pid 1072] <... futex resumed>) = 0 [pid 1085] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1083] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1085] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1081] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1083] <... futex resumed>) = 0 [pid 1085] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1083] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1081] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1079] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1072] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1085] <... write resumed>) = 1045 [pid 1081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1080] <... futex resumed>) = 1 [pid 1079] <... write resumed>) = 8 [pid 1073] <... futex resumed>) = 0 [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1067] +++ exited with 0 +++ [pid 1085] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1080] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1079] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1073] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1072] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1085] <... futex resumed>) = 1 [pid 1083] <... futex resumed>) = 0 [pid 1081] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1085] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1073] <... futex resumed>) = 1 [pid 1081] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1079] <... futex resumed>) = 0 [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1072] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1067, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1081] <... mprotect resumed>) = 0 [pid 1079] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1072] <... futex resumed>) = 0 [pid 294] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1072] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1081] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1081] <... rt_sigprocmask resumed>[], 8) = 0 [pid 294] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1079] <... write resumed>) = 1045 [pid 294] <... openat resumed>) = 3 [pid 1080] <... futex resumed>) = 0 [pid 1079] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1080] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1079] <... futex resumed>) = 1 [pid 1072] <... futex resumed>) = 0 [pid 294] newfstatat(3, "", [pid 1081] <... clone3 resumed> => {parent_tid=[1089]}, 88) = 1089 [pid 1079] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1081] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1080] <... write resumed>) = 8 [pid 294] getdents64(3, [pid 1081] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1080] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] <... futex resumed>) = 0 [pid 1080] <... futex resumed>) = 1 [pid 1073] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1081] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1080] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1073] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1081] <... futex resumed>) = 0 [pid 1080] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1073] <... futex resumed>) = 0 [pid 1081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1080] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 294] <... umount2 resumed>) = 0 [pid 1081] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1073] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1081] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1080] <... write resumed>) = 1045 [pid 294] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1081] <... mprotect resumed>) = 0 [pid 1080] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1081] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] newfstatat(AT_FDCWD, "./26/bus", [pid 1081] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1080] <... futex resumed>) = 1 [pid 1073] <... futex resumed>) = 0 [pid 1081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1080] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./26/bus" [pid 1081] <... clone3 resumed> => {parent_tid=[1091]}, 88) = 1091 [pid 1081] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... unlink resumed>) = 0 [pid 1081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1081] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1081] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./26/binderfs") = 0 [ 30.474070][ T1077] loop5: detected capacity change from 0 to 512 [ 30.480647][ T1076] loop1: detected capacity change from 0 to 512 [ 30.489551][ T1070] EXT4-fs (loop2): 1 orphan inode deleted [ 30.491812][ T1084] loop3: detected capacity change from 0 to 512 [ 30.495350][ T1070] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/26/file1 supports timestamps until 2038 (0x7fffffff) [pid 294] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./26/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./26/file1") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./26") = 0 [pid 294] mkdir("./27", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1093 ./strace-static-x86_64: Process 1093 attached ./strace-static-x86_64: Process 1091 attached ./strace-static-x86_64: Process 1089 attached [pid 1070] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1070] ioctl(5, LOOP_CLR_FD [pid 1081] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1081] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1093] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1093] chdir("./27") = 0 [pid 1093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1093] setpgid(0, 0) = 0 [pid 1093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1091] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1081] <... futex resumed>) = 0 [ 30.576574][ T1076] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.578152][ T1077] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.589668][ T1084] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.616497][ T1077] EXT4-fs (loop5): get root inode failed [pid 1081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ac000 [pid 1081] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 1093] <... openat resumed>) = 3 [pid 1089] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1081] <... mprotect resumed>) = 0 [pid 1093] write(3, "1000", 4 [pid 1089] <... set_robust_list resumed>) = 0 [pid 1081] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1093] <... write resumed>) = 4 [pid 1089] rt_sigprocmask(SIG_SETMASK, [], [pid 1081] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1093] close(3 [pid 1089] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 1093] <... close resumed>) = 0 [pid 1093] symlink("/dev/binderfs", "./binderfs" [pid 1089] memfd_create("syzkaller", 0 [pid 1091] <... set_robust_list resumed>) = 0 [pid 1091] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1091] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1070] <... ioctl resumed>) = 0 [pid 1081] <... clone3 resumed> => {parent_tid=[1097]}, 88) = 1097 [pid 1081] rt_sigprocmask(SIG_SETMASK, [], [pid 1091] <... open resumed>) = 3 [pid 1091] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1091] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1093] <... symlink resumed>) = 0 [pid 1089] <... memfd_create resumed>) = 4 [pid 1081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1070] close(5 [pid 1081] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1070] <... close resumed>) = 0 [pid 1081] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1093] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1089] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1076] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1070] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1093] <... futex resumed>) = 0 [pid 1089] <... mmap resumed>) = 0x7f0c41dac000 [pid 1070] <... futex resumed>) = 0 [pid 1093] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1076] ioctl(4, LOOP_CLR_FD) = 0 [pid 1076] close(4) = 0 [pid 1076] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1076] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1097 attached [pid 1097] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 1089] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1073] exit_group(0 [pid 1065] exit_group(0 [pid 1070] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1073] <... exit_group resumed>) = ? [pid 1080] <... futex resumed>) = ? [pid 1076] <... futex resumed>) = ? [pid 1065] <... exit_group resumed>) = ? [pid 1071] <... futex resumed>) = -1 (errno 18446744073709551555) [pid 1080] +++ exited with 0 +++ [pid 1070] <... futex resumed>) = ? [pid 1071] +++ exited with 0 +++ [pid 1070] +++ exited with 0 +++ [pid 1065] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1065, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 1093] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1097] rt_sigprocmask(SIG_SETMASK, [], [pid 1089] <... write resumed>) = 262144 [pid 1084] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1077] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] <... restart_syscall resumed>) = 0 [pid 1093] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1084] ioctl(4, LOOP_CLR_FD) = 0 [pid 1084] close(4) = 0 [pid 1084] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1084] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1097] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1097] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1097] <... mount resumed>) = 0 [pid 1097] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1097] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1077] ioctl(4, LOOP_CLR_FD) = 0 [pid 1077] close(4) = 0 [pid 1077] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1077] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1089] munmap(0x7f0c41dac000, 138412032) = 0 [pid 1081] <... futex resumed>) = 0 [pid 1081] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1083] exit_group(0 [pid 1091] <... futex resumed>) = 0 [pid 1081] <... futex resumed>) = 1 [pid 296] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1091] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1085] <... futex resumed>) = ? [pid 1083] <... exit_group resumed>) = ? [pid 1072] exit_group(0 [pid 1089] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 5 [pid 1089] ioctl(5, LOOP_SET_FD, 4 [pid 1093] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1085] +++ exited with 0 +++ [pid 1084] <... futex resumed>) = ? [pid 1081] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1079] <... futex resumed>) = ? [pid 1072] <... exit_group resumed>) = ? [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1093] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1079] +++ exited with 0 +++ [pid 296] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1093] <... mprotect resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 1093] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] newfstatat(3, "", [pid 1093] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 1093] <... clone3 resumed> => {parent_tid=[1098]}, 88) = 1098 [pid 296] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [ 30.622528][ T1076] EXT4-fs (loop1): get root inode failed [ 30.628017][ T1076] EXT4-fs (loop1): mount failed [ 30.633171][ T1077] EXT4-fs (loop5): mount failed [ 30.633587][ T1084] EXT4-fs (loop3): get root inode failed [ 30.648036][ T1084] EXT4-fs (loop3): mount failed [pid 1093] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1098 attached [pid 1093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1091] <... open resumed>) = 6 [pid 1089] <... ioctl resumed>) = 0 [pid 1077] <... futex resumed>) = ? [pid 296] newfstatat(AT_FDCWD, "./26/binderfs", [pid 1098] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1093] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1091] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1089] close(4 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1093] <... futex resumed>) = 0 [pid 1091] <... futex resumed>) = 1 [pid 1081] <... futex resumed>) = 0 [pid 296] unlink("./26/binderfs" [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1091] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1089] <... close resumed>) = 0 [pid 1091] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1081] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1091] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1089] mkdir("./bus", 0777 [pid 1093] <... futex resumed>) = 0 [pid 1081] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 1093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1091] <... write resumed>) = 8 [pid 1089] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1081] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1093] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1091] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1098] <... set_robust_list resumed>) = 0 [pid 1093] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1091] <... futex resumed>) = 0 [pid 1089] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1081] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./26/file1", [pid 1093] <... mprotect resumed>) = 0 [pid 1091] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1081] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1098] rt_sigprocmask(SIG_SETMASK, [], [pid 1093] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1091] <... write resumed>) = 1045 [pid 1081] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1098] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1093] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1091] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1081] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] unlink("./26/file1" [pid 1093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] <... unlink resumed>) = 0 [pid 1098] memfd_create("syzkaller", 0 [pid 296] getdents64(3, [pid 1098] <... memfd_create resumed>) = 3 [pid 1093] <... clone3 resumed> => {parent_tid=[1099]}, 88) = 1099 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1098] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1093] rt_sigprocmask(SIG_SETMASK, [], [pid 296] close(3 [pid 1098] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... close resumed>) = 0 [pid 1098] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1093] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./26" [pid 1093] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 1099 attached [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1091] <... futex resumed>) = 0 [pid 1089] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] mkdir("./27", 0777 [pid 1099] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1098] <... write resumed>) = 262144 [pid 1091] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1089] ioctl(5, LOOP_CLR_FD [pid 1076] +++ exited with 0 +++ [pid 1073] +++ exited with 0 +++ [pid 1099] <... set_robust_list resumed>) = 0 [pid 1098] munmap(0x7f0c41dcd000, 138412032 [pid 1089] <... ioctl resumed>) = 0 [pid 1099] rt_sigprocmask(SIG_SETMASK, [], [pid 1098] <... munmap resumed>) = 0 [pid 1089] close(5 [pid 1099] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1098] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1089] <... close resumed>) = 0 [pid 1099] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1098] <... openat resumed>) = 4 [pid 1089] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1099] <... open resumed>) = 5 [pid 1098] ioctl(4, LOOP_SET_FD, 3 [pid 1089] <... futex resumed>) = 0 [pid 1099] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1089] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... mkdir resumed>) = 0 [pid 1081] exit_group(0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1073, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1091] <... futex resumed>) = ? [pid 1081] <... exit_group resumed>) = ? [pid 296] <... openat resumed>) = 3 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1091] +++ exited with 0 +++ [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... restart_syscall resumed>) = 0 [pid 1099] <... futex resumed>) = 1 [pid 1098] <... ioctl resumed>) = 0 [pid 1097] <... futex resumed>) = ? [pid 1093] <... futex resumed>) = 0 [pid 1089] <... futex resumed>) = ? [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1099] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1098] close(3 [pid 1097] +++ exited with 0 +++ [pid 1093] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 1099] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1098] <... close resumed>) = 0 [pid 1093] <... futex resumed>) = 0 [pid 1099] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1098] mkdir("./bus", 0777 [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1099] <... mount resumed>) = 0 [pid 1098] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1099] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1098] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1093] <... futex resumed>) = 0 [pid 1099] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1093] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1099] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1093] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1099] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1099] <... open resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1099] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1093] <... futex resumed>) = 0 [pid 1099] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1093] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1099] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1093] <... futex resumed>) = 0 [pid 1099] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1099] <... write resumed>) = 8 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1100 [pid 1099] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 1099] <... futex resumed>) = 1 [pid 1093] <... futex resumed>) = 0 [pid 295] newfstatat(3, "", [pid 1099] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1093] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1084] +++ exited with 0 +++ [pid 1083] +++ exited with 0 +++ [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1099] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1093] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1083, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] getdents64(3, [pid 1099] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1093] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... restart_syscall resumed>) = 0 [pid 295] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1099] <... write resumed>) = 1045 [pid 1099] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1099] <... futex resumed>) = 1 [pid 1093] <... futex resumed>) = 0 [pid 1099] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = 0 [pid 297] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1100 attached [pid 297] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 295] newfstatat(AT_FDCWD, "./25/bus", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 295] unlink("./25/bus" [pid 1100] set_robust_list(0x555556d8d6a0, 24 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1100] <... set_robust_list resumed>) = 0 [pid 1100] chdir("./27" [pid 297] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 1100] <... chdir resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1100] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1100] <... prctl resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./25/binderfs", [pid 297] newfstatat(AT_FDCWD, "./26/bus", [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./25/binderfs" [pid 297] unlink("./26/bus" [pid 1100] setpgid(0, 0) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1100] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... unlink resumed>) = 0 [pid 295] getdents64(3, [pid 297] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 297] newfstatat(AT_FDCWD, "./26/binderfs", [pid 295] <... close resumed>) = 0 [pid 1100] <... openat resumed>) = 3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] rmdir("./25" [pid 1100] write(3, "1000", 4 [pid 297] unlink("./26/binderfs" [pid 1100] <... write resumed>) = 4 [pid 1100] close(3) = 0 [pid 1100] symlink("/dev/binderfs", "./binderfs" [pid 295] <... rmdir resumed>) = 0 [pid 1100] <... symlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 295] mkdir("./26", 0777 [pid 297] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1100] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1100] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 295] <... mkdir resumed>) = 0 [pid 1100] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1100] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] newfstatat(AT_FDCWD, "./26/file1", [pid 1100] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] <... openat resumed>) = 3 [pid 1100] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 1100] <... mprotect resumed>) = 0 [pid 1100] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1100] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1101]}, 88) = 1101 [pid 1100] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1100] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1100] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1100] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1100] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1077] +++ exited with 0 +++ [pid 1072] +++ exited with 0 +++ [pid 1100] <... clone3 resumed> => {parent_tid=[1102]}, 88) = 1102 [pid 1100] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1100] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1102 attached [pid 1102] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1102] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1102] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1102] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1100] <... futex resumed>) = 0 [pid 1100] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1102] <... futex resumed>) = 1 [pid 1102] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 1101 attached [pid 1101] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1101] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1101] memfd_create("syzkaller", 0 [pid 1102] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1100] <... futex resumed>) = 0 [pid 1100] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1102] <... futex resumed>) = 1 [pid 1102] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1101] <... memfd_create resumed>) = 5 [pid 1102] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1100] <... futex resumed>) = 0 [pid 1100] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1102] <... futex resumed>) = 1 [pid 1101] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1102] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1101] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1102] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1102] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1100] <... futex resumed>) = 0 [pid 1100] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1100] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1102] <... futex resumed>) = 1 [pid 1102] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 1102] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1100] <... futex resumed>) = 0 [pid 1102] <... futex resumed>) = 1 [pid 1102] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1072, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 297] openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(4, "", [pid 1101] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] getdents64(4, [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1103 [pid 299] <... openat resumed>) = 3 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] newfstatat(3, "", [pid 297] getdents64(4, [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] getdents64(3, [pid 297] close(4 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] rmdir("./26/file1" [pid 299] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./28/bus", [pid 297] getdents64(3, [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] unlink("./28/bus" [pid 297] close(3./strace-static-x86_64: Process 1103 attached [pid 299] <... unlink resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 299] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./26" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1098] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./28/binderfs", [pid 297] <... rmdir resumed>) = 0 [pid 1103] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1098] ioctl(4, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] mkdir("./27", 0777 [pid 299] unlink("./28/binderfs" [pid 297] <... mkdir resumed>) = 0 [pid 1098] <... ioctl resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 299] getdents64(3, [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1103] chdir("./26" [pid 1098] close(4 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... openat resumed>) = 3 [pid 1098] <... close resumed>) = 0 [pid 299] close(3 [pid 1103] <... chdir resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 1103] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1101] <... write resumed>) = 262144 [pid 1098] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1098] <... futex resumed>) = 0 [pid 299] rmdir("./28" [pid 297] close(3 [pid 1098] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1093] exit_group(0 [pid 299] <... rmdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 1099] <... futex resumed>) = ? [pid 1098] <... futex resumed>) = ? [pid 1093] <... exit_group resumed>) = ? [pid 299] mkdir("./29", 0777 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1103] <... prctl resumed>) = 0 [pid 1101] munmap(0x7f0c41dcd000, 138412032 [pid 1099] +++ exited with 0 +++ [pid 1098] +++ exited with 0 +++ [pid 299] <... mkdir resumed>) = 0 [pid 1101] <... munmap resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1101] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 299] <... openat resumed>) = 3 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1104 [pid 299] ioctl(3, LOOP_CLR_FD [pid 1101] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 1104 attached [ 30.671569][ T1089] loop4: detected capacity change from 0 to 512 [ 30.681276][ T1089] EXT4-fs (loop4): Invalid log block size: 2475723007 [ 30.691951][ T1098] loop0: detected capacity change from 0 to 512 [ 30.707364][ T1098] EXT4-fs (loop0): Invalid log block size: 2475723007 [pid 1103] setpgid(0, 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1104] set_robust_list(0x555556d8d6a0, 24 [pid 1103] <... setpgid resumed>) = 0 [pid 299] close(3 [pid 1104] <... set_robust_list resumed>) = 0 [pid 1103] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... close resumed>) = 0 [pid 1104] chdir("./27" [pid 1103] <... openat resumed>) = 3 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1104] <... chdir resumed>) = 0 [pid 1103] write(3, "1000", 4 [pid 1104] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1103] <... write resumed>) = 4 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1105 ./strace-static-x86_64: Process 1105 attached [pid 1104] <... prctl resumed>) = 0 [pid 1103] close(3 [pid 1101] <... ioctl resumed>) = 0 [pid 1105] set_robust_list(0x555556d8d6a0, 24 [pid 1103] <... close resumed>) = 0 [pid 1101] close(5 [pid 1105] <... set_robust_list resumed>) = 0 [pid 1101] <... close resumed>) = 0 [pid 1103] symlink("/dev/binderfs", "./binderfs" [pid 1105] chdir("./29" [pid 1101] mkdir("./file1", 0777 [pid 1104] setpgid(0, 0 [pid 1103] <... symlink resumed>) = 0 [pid 1105] <... chdir resumed>) = 0 [pid 1101] <... mkdir resumed>) = 0 [pid 1103] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1105] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1101] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1104] <... setpgid resumed>) = 0 [pid 1103] <... futex resumed>) = 0 [pid 1105] <... prctl resumed>) = 0 [pid 1105] setpgid(0, 0 [pid 1103] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1103] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1105] <... setpgid resumed>) = 0 [pid 1105] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1103] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1105] <... openat resumed>) = 3 [pid 1103] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1105] write(3, "1000", 4) = 4 [pid 1105] close(3 [pid 1103] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1105] <... close resumed>) = 0 [pid 1103] <... mprotect resumed>) = 0 [pid 1105] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1103] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1105] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1105] <... futex resumed>) = 0 [pid 1105] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1105] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1103] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1105] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1105] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1103] <... clone3 resumed> => {parent_tid=[1106]}, 88) = 1106 [pid 1105] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1105] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1103] rt_sigprocmask(SIG_SETMASK, [], [pid 1104] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 1107 attached ./strace-static-x86_64: Process 1106 attached [pid 1105] <... clone3 resumed> => {parent_tid=[1107]}, 88) = 1107 [pid 1104] <... openat resumed>) = 3 [pid 1103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1106] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1104] write(3, "1000", 4 [pid 1103] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1107] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1106] <... set_robust_list resumed>) = 0 [pid 1105] rt_sigprocmask(SIG_SETMASK, [], [pid 1104] <... write resumed>) = 4 [pid 1103] <... futex resumed>) = 0 [pid 1107] <... set_robust_list resumed>) = 0 [pid 1106] rt_sigprocmask(SIG_SETMASK, [], [pid 1105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1104] close(3 [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1107] rt_sigprocmask(SIG_SETMASK, [], [pid 1105] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1104] <... close resumed>) = 0 [pid 1103] <... futex resumed>) = 0 [pid 1107] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1105] <... futex resumed>) = 0 [pid 1107] memfd_create("syzkaller", 0 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1104] symlink("/dev/binderfs", "./binderfs" [pid 1103] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1107] <... memfd_create resumed>) = 3 [pid 1105] <... futex resumed>) = 0 [pid 1107] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1107] <... mmap resumed>) = 0x7f0c41dee000 [pid 1105] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1106] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1104] <... symlink resumed>) = 0 [pid 1103] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1106] memfd_create("syzkaller", 0 [pid 1105] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 1104] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1107] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1105] <... mprotect resumed>) = 0 [pid 1106] <... memfd_create resumed>) = 3 [pid 1105] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1104] <... futex resumed>) = 0 [pid 1103] <... mprotect resumed>) = 0 [pid 1107] <... write resumed>) = 262144 [pid 1106] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1105] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1104] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1103] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1106] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1104] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1103] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1089] +++ exited with 0 +++ [pid 1081] +++ exited with 0 +++ [pid 1106] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1104] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1103] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1093] +++ exited with 0 +++ [pid 1106] <... write resumed>) = 262144 [pid 1104] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1081, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1093, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1105] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 1104] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1103] <... clone3 resumed> => {parent_tid=[1108]}, 88) = 1108 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1106] munmap(0x7f0c41dcd000, 138412032 [pid 1104] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1103] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... restart_syscall resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 1107] munmap(0x7f0c41dee000, 138412032 [pid 1106] <... munmap resumed>) = 0 [pid 1105] <... clone3 resumed> => {parent_tid=[1109]}, 88) = 1109 [pid 1104] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1107] <... munmap resumed>) = 0 [pid 1106] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1105] rt_sigprocmask(SIG_SETMASK, [], [pid 1104] <... mprotect resumed>) = 0 [pid 1103] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1107] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1106] <... openat resumed>) = 4 [pid 1105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1104] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1103] <... futex resumed>) = 0 [pid 298] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1107] <... openat resumed>) = 4 [pid 1106] ioctl(4, LOOP_SET_FD, 3 [pid 1105] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1104] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1109 attached ./strace-static-x86_64: Process 1108 attached [pid 1107] ioctl(4, LOOP_SET_FD, 3 [pid 1106] <... ioctl resumed>) = 0 [pid 1105] <... futex resumed>) = 0 [pid 1104] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1109] set_robust_list(0x7f0c41ded9a0, 24 [pid 1108] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 298] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 1104] <... clone3 resumed> => {parent_tid=[1111]}, 88) = 1111 [pid 298] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 1104] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1104] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(3, [pid 294] getdents64(3, [pid 1104] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1104] <... futex resumed>) = 0 [pid 298] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1104] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1104] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1109] <... set_robust_list resumed>) = 0 [pid 1108] <... set_robust_list resumed>) = 0 [pid 1107] <... ioctl resumed>) = 0 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1104] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1109] rt_sigprocmask(SIG_SETMASK, [], [pid 1104] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1104] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1104] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] newfstatat(AT_FDCWD, "./25/bus", [pid 294] newfstatat(AT_FDCWD, "./27/bus", [pid 1109] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1108] rt_sigprocmask(SIG_SETMASK, [], [pid 1107] close(3 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1109] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1108] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1104] <... clone3 resumed> => {parent_tid=[1112]}, 88) = 1112 [pid 298] unlink("./25/bus" [pid 294] unlink("./27/bus" [pid 1109] <... open resumed>) = 5 [pid 1108] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1104] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1109] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] <... open resumed>) = 5 [pid 1107] <... close resumed>) = 0 [pid 1104] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1109] <... futex resumed>) = 1 [pid 1108] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1107] mkdir("./bus", 0777 [pid 1105] <... futex resumed>) = 0 [pid 1104] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1109] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1108] <... futex resumed>) = 1 [pid 1105] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1104] <... futex resumed>) = 0 [pid 1103] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./25/binderfs", [pid 294] newfstatat(AT_FDCWD, "./27/binderfs", [pid 1109] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1108] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1106] close(3 [pid 1105] <... futex resumed>) = 0 [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1103] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1109] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1108] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1107] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1106] <... close resumed>) = 0 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1103] <... futex resumed>) = 0 [pid 298] unlink("./25/binderfs" [pid 294] unlink("./27/binderfs" [pid 1109] <... mount resumed>) = 0 [pid 1108] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1107] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1106] mkdir("./bus", 0777 [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1109] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] <... mount resumed>) = 0 [pid 1106] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] getdents64(3, [pid 294] getdents64(3, ./strace-static-x86_64: Process 1111 attached [pid 1109] <... futex resumed>) = 1 [pid 1108] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1106] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1105] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1109] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1108] <... futex resumed>) = 1 [pid 1105] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] <... futex resumed>) = 0 [ 30.728167][ T1101] loop2: detected capacity change from 0 to 512 [ 30.759827][ T1106] loop1: detected capacity change from 0 to 512 [ 30.766890][ T1107] loop5: detected capacity change from 0 to 512 [pid 298] close(3 [pid 294] close(3 [pid 298] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 298] rmdir("./25" [pid 294] rmdir("./27" [pid 298] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 298] mkdir("./26", 0777 [pid 294] mkdir("./28", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 1109] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1108] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1105] <... futex resumed>) = 0 [pid 1103] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 294] ioctl(3, LOOP_CLR_FD [pid 1109] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1108] <... open resumed>) = 3 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1103] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1111] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1109] <... open resumed>) = 3 [pid 1108] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] close(3 [pid 294] close(3 [pid 1111] <... set_robust_list resumed>) = 0 [pid 1109] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] <... futex resumed>) = 0 [pid 1103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 ./strace-static-x86_64: Process 1112 attached [pid 1111] rt_sigprocmask(SIG_SETMASK, [], [pid 1109] <... futex resumed>) = 1 [pid 1108] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1105] <... futex resumed>) = 0 [pid 1103] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1112] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1111] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1109] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1108] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1105] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] <... futex resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1115 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1117 [pid 1109] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1108] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1105] <... futex resumed>) = 0 [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1112] <... set_robust_list resumed>) = 0 [pid 1111] memfd_create("syzkaller", 0 [pid 1109] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1108] <... write resumed>) = 8 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1112] rt_sigprocmask(SIG_SETMASK, [], [pid 1111] <... memfd_create resumed>) = 3 [pid 1109] <... write resumed>) = 8 [pid 1108] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1112] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1109] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] <... futex resumed>) = 1 [pid 1103] <... futex resumed>) = 0 [pid 1109] <... futex resumed>) = 1 [pid 1105] <... futex resumed>) = 0 [pid 1101] <... mount resumed>) = 0 [pid 1101] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 1101] chdir("./file1") = 0 [pid 1101] ioctl(6, LOOP_CLR_FD) = 0 [pid 1101] close(6) = 0 [pid 1101] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1101] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1115 attached [pid 1115] set_robust_list(0x555556d8d6a0, 24 [pid 1108] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1112] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1111] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1109] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1108] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1105] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1103] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1105] <... futex resumed>) = 0 [pid 1103] <... futex resumed>) = 0 [pid 1109] <... write resumed>) = 1045 [pid 1111] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1105] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1103] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1109] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1108] <... write resumed>) = 1045 [pid 1105] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1109] <... futex resumed>) = 0 [pid 1108] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1109] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1108] <... futex resumed>) = 1 [pid 1103] <... futex resumed>) = 0 [pid 1108] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1100] exit_group(0 [pid 1102] <... futex resumed>) = ? [pid 1100] <... exit_group resumed>) = ? [pid 1102] +++ exited with 0 +++ [pid 1101] <... futex resumed>) = ? [pid 1112] <... open resumed>) = 4 [pid 1111] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1112] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1104] <... futex resumed>) = 0 [pid 1112] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1104] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1112] <... mount resumed>) = 0 [pid 1104] <... futex resumed>) = 0 [ 30.797630][ T1101] EXT4-fs (loop2): 1 orphan inode deleted [ 30.809340][ T1101] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/27/file1 supports timestamps until 2038 (0x7fffffff) [ 30.825915][ T1107] EXT4-fs (loop5): 1 orphan inode deleted [pid 1115] <... set_robust_list resumed>) = 0 [pid 1112] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1111] <... write resumed>) = 262144 [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1101] +++ exited with 0 +++ [pid 1100] +++ exited with 0 +++ [pid 1104] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1100, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1104] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1112] <... futex resumed>) = 0 [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1112] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1112] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1104] <... futex resumed>) = 0 [pid 1112] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1111] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1111] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 1104] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1111] ioctl(6, LOOP_SET_FD, 3 [pid 1104] <... futex resumed>) = 1 [pid 1112] <... futex resumed>) = 0 [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1115] chdir("./26" [pid 296] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1115] <... chdir resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1115] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1115] <... prctl resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 1115] setpgid(0, 0 [pid 296] newfstatat(3, "", [pid 1115] <... setpgid resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 1112] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1115] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1115] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1115] write(3, "1000", 4 [pid 296] newfstatat(AT_FDCWD, "./27/bus", [pid 1115] <... write resumed>) = 4 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1115] close(3 [pid 296] unlink("./27/bus" [pid 1115] <... close resumed>) = 0 [pid 1115] symlink("/dev/binderfs", "./binderfs" [pid 296] <... unlink resumed>) = 0 [pid 1115] <... symlink resumed>) = 0 [pid 296] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./27/binderfs" [pid 1115] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] <... unlink resumed>) = 0 [pid 1115] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1115] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1115] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1115] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1115] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1115] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1119]}, 88) = 1119 [pid 1115] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1115] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1115] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1115] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1115] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1120]}, 88) = 1120 [pid 1115] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1115] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1111] <... ioctl resumed>) = 0 [pid 1111] close(3) = 0 [pid 1111] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1111] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1112] <... write resumed>) = 8 ./strace-static-x86_64: Process 1120 attached ./strace-static-x86_64: Process 1119 attached ./strace-static-x86_64: Process 1117 attached [pid 1112] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1104] <... futex resumed>) = 0 [pid 1112] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1104] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1112] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1104] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1112] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = 1045 [pid 1117] set_robust_list(0x555556d8d6a0, 24 [pid 1112] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1117] <... set_robust_list resumed>) = 0 [pid 1104] <... futex resumed>) = 0 [pid 1112] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1117] chdir("./28") = 0 [pid 1117] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1117] setpgid(0, 0) = 0 [pid 1117] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1117] write(3, "1000", 4 [pid 1120] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1119] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1117] <... write resumed>) = 4 [pid 1119] <... set_robust_list resumed>) = 0 [pid 1120] <... set_robust_list resumed>) = 0 [pid 1117] close(3 [pid 1120] rt_sigprocmask(SIG_SETMASK, [], [pid 1119] rt_sigprocmask(SIG_SETMASK, [], [pid 1117] <... close resumed>) = 0 [pid 1117] symlink("/dev/binderfs", "./binderfs" [pid 1120] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1119] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1117] <... symlink resumed>) = 0 [pid 1117] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1117] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1117] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1117] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1117] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1117] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1117] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1122]}, 88) = 1122 [pid 1117] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1117] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1117] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1117] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1117] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1117] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1123]}, 88) = 1123 [pid 1117] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1117] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1120] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1119] memfd_create("syzkaller", 0) = 4 [pid 1119] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1120] <... open resumed>) = 3 [pid 1120] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1115] <... futex resumed>) = 0 [pid 1115] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1120] <... futex resumed>) = 1 ./strace-static-x86_64: Process 1122 attached [pid 1120] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 1119] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1120] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1115] <... futex resumed>) = 0 [pid 1115] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1120] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = -1 ENOENT (No such file or directory) [pid 1120] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1115] <... futex resumed>) = 0 [pid 1122] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1120] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1119] <... write resumed>) = 262144 [pid 1115] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1120] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1119] munmap(0x7f0c41dcd000, 138412032 [pid 1115] <... futex resumed>) = 0 [ 30.842499][ T1111] loop3: detected capacity change from 0 to 512 [ 30.857735][ T1107] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/29/bus supports timestamps until 2038 (0x7fffffff) [ 30.877581][ T1106] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 30.891208][ T1106] EXT4-fs (loop1): get root inode failed [pid 1120] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1119] <... munmap resumed>) = 0 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1120] <... futex resumed>) = 0 [pid 1119] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1115] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 1123 attached [pid 1120] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1119] <... openat resumed>) = 5 [pid 1115] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1123] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1122] <... set_robust_list resumed>) = 0 [pid 1120] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1119] ioctl(5, LOOP_SET_FD, 4 [pid 1115] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1123] <... set_robust_list resumed>) = 0 [pid 1120] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1115] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1122] rt_sigprocmask(SIG_SETMASK, [], [pid 296] newfstatat(AT_FDCWD, "./27/file1", [pid 1123] rt_sigprocmask(SIG_SETMASK, [], [pid 1120] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1123] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1122] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1120] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1123] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1122] memfd_create("syzkaller", 0 [pid 1120] <... futex resumed>) = 1 [pid 1115] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1123] <... open resumed>) = 3 [pid 1120] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1123] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 1123] <... futex resumed>) = 1 [pid 1117] <... futex resumed>) = 0 [pid 296] newfstatat(4, "", [pid 1123] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1117] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1123] <... mount resumed>) = 0 [pid 1117] <... futex resumed>) = 0 [pid 296] getdents64(4, [pid 1123] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1123] <... futex resumed>) = 0 [pid 1117] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] getdents64(4, [pid 1123] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1122] <... memfd_create resumed>) = 4 [pid 1117] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1123] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1117] <... futex resumed>) = 0 [pid 296] close(4 [pid 1123] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... close resumed>) = 0 [pid 1123] <... open resumed>) = 5 [pid 296] rmdir("./27/file1" [pid 1123] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 1123] <... futex resumed>) = 1 [pid 1117] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 1123] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1117] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1123] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1117] <... futex resumed>) = 0 [pid 296] close(3 [pid 1123] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... close resumed>) = 0 [pid 1123] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 296] rmdir("./27" [pid 1123] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 1123] <... futex resumed>) = 1 [pid 1122] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1117] <... futex resumed>) = 0 [pid 296] mkdir("./28", 0777 [pid 1123] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1117] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 1123] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1117] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1123] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1122] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1117] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 1123] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 296] ioctl(3, LOOP_CLR_FD [pid 1123] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1123] <... futex resumed>) = 1 [pid 1117] <... futex resumed>) = 0 [pid 296] close(3 [pid 1123] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1122] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] <... close resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1126 [pid 1122] <... write resumed>) = 262144 [pid 1122] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1122] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 1122] ioctl(6, LOOP_SET_FD, 4 [pid 1119] <... ioctl resumed>) = 0 [pid 1119] close(4) = 0 [pid 1119] mkdir("./file1", 0777) = -1 EEXIST (File exists) [pid 1119] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1126 attached [pid 1126] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1126] chdir("./28") = 0 [pid 1126] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1126] setpgid(0, 0) = 0 [pid 1126] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1126] write(3, "1000", 4) = 4 [pid 1126] close(3) = 0 [pid 1126] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1126] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1126] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1126] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1126] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1126] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1126] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1126] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1127]}, 88) = 1127 [pid 1126] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1126] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1122] <... ioctl resumed>) = 0 [pid 1126] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1106] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1106] ioctl(4, LOOP_CLR_FD [pid 1126] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1107] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1106] <... ioctl resumed>) = 0 [pid 1122] close(4) = 0 [pid 1107] ioctl(4, LOOP_CLR_FD [pid 1106] close(4 [pid 1126] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1107] <... ioctl resumed>) = 0 [ 30.896727][ T1106] EXT4-fs (loop1): mount failed [ 30.905478][ T1119] loop4: detected capacity change from 0 to 512 [ 30.927232][ T1122] loop0: detected capacity change from 0 to 512 [ 30.933466][ T1111] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1122] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1122] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1127 attached [pid 1127] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1127] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1106] <... close resumed>) = 0 [pid 1126] <... mprotect resumed>) = 0 [pid 1107] close(4 [pid 1127] memfd_create("syzkaller", 0) = 3 [pid 1127] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1106] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1126] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1107] <... close resumed>) = 0 [pid 1126] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1106] <... futex resumed>) = 0 [pid 1106] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1103] exit_group(0 [pid 1108] <... futex resumed>) = ? [pid 1107] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1106] <... futex resumed>) = ? [pid 1103] <... exit_group resumed>) = ? [pid 1126] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1108] +++ exited with 0 +++ [pid 1107] <... futex resumed>) = 0 [pid 1106] +++ exited with 0 +++ [pid 1107] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1105] exit_group(0 [pid 1126] <... clone3 resumed> => {parent_tid=[1130]}, 88) = 1130 [pid 1109] <... futex resumed>) = 1130 [pid 1105] <... exit_group resumed>) = ? [pid 1126] rt_sigprocmask(SIG_SETMASK, [], [pid 1109] +++ exited with 0 +++ [pid 1107] <... futex resumed>) = ? [pid 1126] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1127] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1127] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1126] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1127] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1127] <... openat resumed>) = 4 [pid 1127] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 1127] close(3) = 0 [pid 1127] mkdir("./file1", 0777) = 0 [pid 1127] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1130 attached [pid 1130] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1130] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1130] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1130] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1126] <... futex resumed>) = 0 [pid 1126] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1130] <... futex resumed>) = 1 [pid 1130] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1103] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1103, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1130] <... mount resumed>) = 0 [pid 1107] +++ exited with 0 +++ [pid 1105] +++ exited with 0 +++ [pid 295] <... restart_syscall resumed>) = 0 [pid 1130] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1105, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1130] <... futex resumed>) = 1 [pid 1126] <... futex resumed>) = 0 [pid 1130] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1126] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1126] <... futex resumed>) = 0 [pid 299] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1130] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1130] <... open resumed>) = 5 [pid 299] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 1130] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 295] newfstatat(3, "", [pid 1130] <... futex resumed>) = 1 [pid 1126] <... futex resumed>) = 0 [pid 1111] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] newfstatat(3, "", [pid 1111] ioctl(6, LOOP_CLR_FD) = 0 [pid 1111] close(6) = 0 [pid 1111] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1111] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1130] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1126] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 30.952219][ T1119] EXT4-fs (loop4): 1 orphan inode deleted [ 30.968691][ T1111] EXT4-fs (loop3): get root inode failed [ 30.976128][ T1111] EXT4-fs (loop3): mount failed [ 30.977138][ T1127] loop2: detected capacity change from 0 to 512 [ 30.982106][ T1119] ext4 filesystem being mounted at /root/syzkaller.qPQybd/26/file1 supports timestamps until 2038 (0x7fffffff) [pid 1130] <... write resumed>) = 8 [pid 1126] <... futex resumed>) = 0 [pid 1104] exit_group(0 [pid 299] getdents64(3, [pid 295] getdents64(3, [pid 1130] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1127] <... mount resumed>) = 0 [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1112] <... futex resumed>) = ? [pid 1111] <... futex resumed>) = ? [pid 1104] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1130] <... futex resumed>) = 0 [pid 1126] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1112] +++ exited with 0 +++ [pid 1111] +++ exited with 0 +++ [pid 1130] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1127] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 1127] ioctl(4, LOOP_CLR_FD) = 0 [pid 1127] close(4 [pid 1130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1127] <... close resumed>) = 0 [pid 1126] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1119] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1130] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1127] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1119] ioctl(5, LOOP_CLR_FD [pid 1127] <... futex resumed>) = 0 [pid 1126] <... futex resumed>) = 0 [pid 1127] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1126] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1130] <... write resumed>) = 1045 [pid 299] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 1130] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1130] <... futex resumed>) = 1 [pid 1126] <... futex resumed>) = 0 [pid 295] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1130] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1126] exit_group(0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1130] <... futex resumed>) = ? [pid 1127] <... futex resumed>) = ? [pid 1126] <... exit_group resumed>) = ? [pid 299] newfstatat(AT_FDCWD, "./29/bus", [pid 295] newfstatat(AT_FDCWD, "./26/bus", [pid 1130] +++ exited with 0 +++ [pid 1122] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1127] +++ exited with 0 +++ [pid 1126] +++ exited with 0 +++ [pid 1122] ioctl(6, LOOP_CLR_FD [pid 299] unlink("./29/bus" [pid 295] unlink("./26/bus" [pid 1122] <... ioctl resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1126, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... unlink resumed>) = 0 [pid 1122] close(6 [pid 299] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 295] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1122] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... restart_syscall resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1122] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(AT_FDCWD, "./29/binderfs", [pid 295] newfstatat(AT_FDCWD, "./26/binderfs", [pid 1122] <... futex resumed>) = 0 [pid 1119] <... ioctl resumed>) = 0 [pid 1117] exit_group(0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1123] <... futex resumed>) = ? [pid 1117] <... exit_group resumed>) = ? [pid 299] unlink("./29/binderfs" [pid 296] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./26/binderfs" [pid 1123] +++ exited with 0 +++ [pid 1122] +++ exited with 0 +++ [pid 1119] close(5 [pid 299] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... unlink resumed>) = 0 [pid 299] getdents64(3, [pid 296] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1119] <... close resumed>) = 0 [pid 299] close(3 [pid 296] newfstatat(3, "", [pid 295] close(3 [pid 1119] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... close resumed>) = 0 [pid 1119] <... futex resumed>) = 0 [pid 299] rmdir("./29" [pid 296] getdents64(3, [pid 295] rmdir("./26" [pid 1119] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... rmdir resumed>) = 0 [pid 1115] exit_group(0 [pid 299] mkdir("./30", 0777 [pid 296] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] mkdir("./27", 0777 [pid 1120] <... futex resumed>) = ? [pid 1119] <... futex resumed>) = ? [pid 1115] <... exit_group resumed>) = ? [pid 299] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 1120] +++ exited with 0 +++ [pid 1119] +++ exited with 0 +++ [pid 1115] +++ exited with 0 +++ [pid 1104] +++ exited with 0 +++ [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 295] close(3 [pid 299] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1135 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1136 ./strace-static-x86_64: Process 1136 attached [pid 1136] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1136] chdir("./27") = 0 [pid 1136] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1136] setpgid(0, 0) = 0 [pid 1136] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1136] write(3, "1000", 4) = 4 [pid 1136] close(3) = 0 [pid 1136] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1136] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1136] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1136] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1136] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1136] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1136] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1136] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1137]}, 88) = 1137 [pid 1136] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1136] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1136] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1136] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1136] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1115, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1104, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 296] <... umount2 resumed>) = 0 [pid 1136] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(3, "", [pid 296] newfstatat(AT_FDCWD, "./28/bus", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... openat resumed>) = 3 [pid 298] getdents64(3, [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(3, "", [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] unlink("./28/bus" [pid 298] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./26/binderfs", [pid 297] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./28/binderfs", ./strace-static-x86_64: Process 1135 attached [pid 298] unlink("./26/binderfs" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1135] set_robust_list(0x555556d8d6a0, 24 [pid 298] <... unlink resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./27/bus", [pid 296] unlink("./28/binderfs" [pid 1136] <... clone3 resumed> => {parent_tid=[1138]}, 88) = 1138 [pid 1135] <... set_robust_list resumed>) = 0 [pid 298] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 1138 attached [pid 1136] rt_sigprocmask(SIG_SETMASK, [], [pid 1135] chdir("./30" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] unlink("./27/bus" [pid 296] <... unlink resumed>) = 0 [pid 1136] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1135] <... chdir resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./26/file1", [pid 297] <... unlink resumed>) = 0 [pid 1136] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1136] <... futex resumed>) = 0 [pid 1135] <... prctl resumed>) = 0 [pid 298] unlink("./26/file1" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1138] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] setpgid(0, 0 [pid 298] <... unlink resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./27/binderfs", [pid 1135] <... setpgid resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1138] <... set_robust_list resumed>) = 0 [pid 1135] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] getdents64(3, [pid 297] unlink("./27/binderfs" [pid 1138] rt_sigprocmask(SIG_SETMASK, [], [pid 1135] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 [pid 1135] write(3, "1000", 4 [pid 298] close(3 [pid 297] getdents64(3, [pid 1135] <... write resumed>) = 4 [pid 298] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1135] close(3 [pid 297] close(3 [pid 1135] <... close resumed>) = 0 [pid 298] rmdir("./26" [pid 297] <... close resumed>) = 0 [pid 1135] symlink("/dev/binderfs", "./binderfs" [pid 297] rmdir("./27" [pid 1138] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1135] <... symlink resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./28", 0777 [pid 1138] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1135] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./27", 0777 [pid 297] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 1139 attached [pid 1138] <... open resumed>) = 3 [pid 1135] <... futex resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1139 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1138] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... openat resumed>) = 3 [pid 1135] <... rt_sigaction resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 1137 attached [pid 1137] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1137] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1137] memfd_create("syzkaller", 0) = 4 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1135] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1137] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] close(3 [pid 1137] <... mmap resumed>) = 0x7f0c41dcd000 [pid 298] <... close resumed>) = 0 [pid 1135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1139] set_robust_list(0x555556d8d6a0, 24 [pid 1138] <... futex resumed>) = 1 [pid 1136] <... futex resumed>) = 0 [pid 1135] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1136] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1140 [pid 1139] <... set_robust_list resumed>) = 0 [pid 1138] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1137] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1136] <... futex resumed>) = 0 [pid 1135] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] <... mprotect resumed>) = 0 [pid 1139] chdir("./28" [pid 1138] <... mount resumed>) = 0 [pid 1137] <... write resumed>) = 262144 [pid 1135] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1138] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1140 attached ) = 1 [pid 1136] <... futex resumed>) = 0 [pid 1135] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1136] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1138] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1136] <... futex resumed>) = 0 [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] <... clone3 resumed> => {parent_tid=[1141]}, 88) = 1141 [pid 1138] <... open resumed>) = 5 [pid 1135] rt_sigprocmask(SIG_SETMASK, [], [pid 1138] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1135] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1140] set_robust_list(0x555556d8d6a0, 24 [pid 1138] <... futex resumed>) = 1 [pid 1137] munmap(0x7f0c41dcd000, 138412032 [pid 1136] <... futex resumed>) = 0 [pid 1140] <... set_robust_list resumed>) = 0 [pid 1139] <... chdir resumed>) = 0 [pid 1138] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1137] <... munmap resumed>) = 0 [pid 1136] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... futex resumed>) = 0 [pid 1140] chdir("./27" [pid 1138] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1137] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1136] <... futex resumed>) = 0 [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1140] <... chdir resumed>) = 0 [pid 1139] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1138] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1137] <... openat resumed>) = 6 [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] <... futex resumed>) = 0 [pid 1140] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1137] ioctl(6, LOOP_SET_FD, 4 [pid 1136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 31.020916][ T1122] EXT4-fs (loop0): 1 orphan inode deleted [ 31.021517][ T1127] EXT4-fs (loop2): 1 orphan inode deleted [ 31.026551][ T1122] ext4 filesystem being mounted at /root/syzkaller.iF59aB/28/bus supports timestamps until 2038 (0x7fffffff) [ 31.035213][ T1127] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/28/file1 supports timestamps until 2038 (0x7fffffff) [pid 1135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1140] <... prctl resumed>) = 0 [pid 1139] <... prctl resumed>) = 0 [pid 1138] <... futex resumed>) = 0 [pid 1136] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1140] setpgid(0, 0 [pid 1136] <... futex resumed>) = 0 [pid 1135] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1138] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045./strace-static-x86_64: Process 1141 attached [pid 1140] <... setpgid resumed>) = 0 [pid 1136] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] <... mprotect resumed>) = 0 [pid 1141] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1140] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1141] <... set_robust_list resumed>) = 0 [pid 1140] <... openat resumed>) = 3 [pid 1141] rt_sigprocmask(SIG_SETMASK, [], [pid 1140] write(3, "1000", 4 [pid 1141] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1140] <... write resumed>) = 4 [pid 1141] memfd_create("syzkaller", 0 [pid 1140] close(3 [pid 1141] <... memfd_create resumed>) = 3 [pid 1140] <... close resumed>) = 0 [pid 1141] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1140] symlink("/dev/binderfs", "./binderfs" [pid 1141] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1140] <... symlink resumed>) = 0 [pid 1141] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1140] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1140] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1140] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1140] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1140] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1140] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1140] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1142]}, 88) = 1142 [pid 1140] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1141] <... write resumed>) = 262144 [pid 1140] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1140] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1140] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1140] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1140] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1143]}, 88) = 1143 [pid 1140] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1140] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1141] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1141] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 1141] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1143 attached ./strace-static-x86_64: Process 1142 attached [pid 1139] setpgid(0, 0 [pid 1138] <... write resumed>) = -1 EIO (Input/output error) [pid 1137] <... ioctl resumed>) = 0 [pid 1135] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1138] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1138] <... futex resumed>) = 1 [pid 1135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1138] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1135] <... clone3 resumed> => {parent_tid=[1144]}, 88) = 1144 [pid 1135] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1135] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1137] close(4 [pid 1142] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1137] <... close resumed>) = 0 [pid 1142] <... set_robust_list resumed>) = 0 [pid 1137] mkdir("./file1", 0777 [pid 1142] rt_sigprocmask(SIG_SETMASK, [], [pid 1137] <... mkdir resumed>) = 0 [pid 1143] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1142] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1139] <... setpgid resumed>) = 0 [pid 1143] <... set_robust_list resumed>) = 0 [pid 1142] memfd_create("syzkaller", 0 [pid 1139] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1143] rt_sigprocmask(SIG_SETMASK, [], [pid 1142] <... memfd_create resumed>) = 3 [pid 1139] <... openat resumed>) = 3 [pid 1137] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1136] <... futex resumed>) = 0 [pid 1143] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1142] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1139] write(3, "1000", 4 [pid 1117] +++ exited with 0 +++ [pid 1143] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1142] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1139] <... write resumed>) = 4 [pid 296] <... umount2 resumed>) = 0 [pid 1143] <... open resumed>) = 4 [pid 1142] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1139] close(3 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1117, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- ./strace-static-x86_64: Process 1144 attached [pid 1143] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] <... close resumed>) = 0 [pid 296] umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1143] <... futex resumed>) = 1 [pid 1142] <... write resumed>) = 262144 [pid 1139] symlink("/dev/binderfs", "./binderfs" [pid 294] <... restart_syscall resumed>) = 0 [pid 1143] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1139] <... symlink resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1139] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1139] <... rt_sigaction resumed>NULL, 8) = 0 [pid 294] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1139] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 294] <... openat resumed>) = 3 [pid 1142] munmap(0x7f0c41dcd000, 138412032 [pid 1139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] newfstatat(3, "", [pid 1142] <... munmap resumed>) = 0 [pid 1139] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1142] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1139] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 294] getdents64(3, [pid 1144] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1142] <... openat resumed>) = 5 [pid 1140] <... futex resumed>) = 0 [pid 1139] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1144] <... set_robust_list resumed>) = 0 [pid 1142] ioctl(5, LOOP_SET_FD, 3 [pid 1140] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] <... mprotect resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./28/file1", [pid 294] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1144] rt_sigprocmask(SIG_SETMASK, [], [pid 1143] <... futex resumed>) = 0 [pid 1142] <... ioctl resumed>) = 0 [pid 1141] <... ioctl resumed>) = 0 [pid 1140] <... futex resumed>) = 1 [pid 1139] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1142] close(3 [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1139] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1142] <... close resumed>) = 0 [pid 1139] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1142] mkdir("./bus", 0777 [pid 294] newfstatat(AT_FDCWD, "./28/bus", [pid 1142] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1139] <... clone3 resumed> => {parent_tid=[1147]}, 88) = 1147 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1144] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1143] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1142] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1139] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] unlink("./28/bus" [pid 1144] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1143] <... mount resumed>) = 0 [pid 1139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] openat(AT_FDCWD, "./28/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... unlink resumed>) = 0 [pid 1144] <... open resumed>) = 5 [pid 1143] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 294] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1144] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1143] <... futex resumed>) = 1 [pid 1141] close(3 [pid 1140] <... futex resumed>) = 0 [pid 1139] <... futex resumed>) = 0 [pid 296] newfstatat(4, "", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1144] <... futex resumed>) = 1 [pid 1143] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1141] <... close resumed>) = 0 [pid 1140] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(AT_FDCWD, "./28/binderfs", [pid 1144] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1143] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1141] mkdir("./bus", 0777 [pid 1140] <... futex resumed>) = 0 [pid 1139] <... futex resumed>) = 0 [pid 1135] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1143] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1141] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1139] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1135] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] unlink("./28/binderfs" [pid 1144] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1143] <... open resumed>) = 3 [pid 1141] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1139] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(4, [pid 294] <... unlink resumed>) = 0 [pid 1144] <... mount resumed>) = 0 [pid 1143] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] getdents64(3, [pid 1144] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1143] <... futex resumed>) = 1 [pid 1140] <... futex resumed>) = 0 [pid 1139] <... mprotect resumed>) = 0 [pid 296] close(4 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1144] <... futex resumed>) = 1 [pid 1143] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1140] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1135] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 294] close(3 [pid 1144] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1143] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1140] <... futex resumed>) = 0 [pid 1139] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1135] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./28/file1" [pid 294] <... close resumed>) = 0 ./strace-static-x86_64: Process 1147 attached [pid 1144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1143] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1139] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1135] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 294] rmdir("./28" [pid 1147] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1144] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1143] <... write resumed>) = 8 [ 31.094312][ T1137] loop1: detected capacity change from 0 to 512 [ 31.101141][ T54] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 31.107936][ T1141] loop5: detected capacity change from 0 to 512 [ 31.131046][ T1142] loop4: detected capacity change from 0 to 512 [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 1139] <... clone3 resumed> => {parent_tid=[1150]}, 88) = 1150 [pid 294] mkdir("./29", 0777 [pid 1139] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... mkdir resumed>) = 0 [pid 1139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1139] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... openat resumed>) = 3 [pid 1139] <... futex resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 1139] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1151 ./strace-static-x86_64: Process 1151 attached [pid 1151] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1151] chdir("./29") = 0 [pid 1151] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1151] setpgid(0, 0 [pid 1144] <... open resumed>) = 3 [pid 1143] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1151] <... setpgid resumed>) = 0 [pid 1151] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1144] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1143] <... futex resumed>) = 1 [pid 1140] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1144] <... futex resumed>) = 1 [pid 1143] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1140] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1135] <... futex resumed>) = 0 [pid 296] close(3 [pid 1144] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1143] <... write resumed>) = 1045 [pid 1140] <... futex resumed>) = 0 [pid 1135] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 1144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1143] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1140] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] <... futex resumed>) = 0 [pid 296] rmdir("./28" [pid 1144] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1143] <... futex resumed>) = 0 [pid 1140] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1144] <... write resumed>) = 8 [pid 1143] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... rmdir resumed>) = 0 [pid 1144] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] mkdir("./29", 0777 [pid 1147] <... set_robust_list resumed>) = 0 [pid 1144] <... futex resumed>) = 1 [pid 1135] <... futex resumed>) = 0 [pid 1151] <... openat resumed>) = 3 [pid 1144] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1135] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 1147] rt_sigprocmask(SIG_SETMASK, [], [pid 1151] write(3, "1000", 4 [pid 1144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1135] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1151] <... write resumed>) = 4 [pid 1147] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1144] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1135] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 1151] close(3 [pid 1147] memfd_create("syzkaller", 0 [pid 1144] <... write resumed>) = 1045 [pid 296] ioctl(3, LOOP_CLR_FD [pid 1151] <... close resumed>) = 0 [pid 1151] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1151] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1151] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1151] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1151] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1151] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1151] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1151] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1153]}, 88) = 1153 [pid 1151] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1151] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1151] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1151] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1151] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1151] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1154]}, 88) = 1154 [pid 1151] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1151] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1144] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1144] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1135] <... futex resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1147] <... memfd_create resumed>) = 3 [pid 296] close(3 [pid 1147] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... close resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1156 ./strace-static-x86_64: Process 1153 attached [pid 1153] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1153] rt_sigprocmask(SIG_SETMASK, [], [pid 1147] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1153] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1153] memfd_create("syzkaller", 0./strace-static-x86_64: Process 1154 attached ) = 3 [pid 1154] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1153] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1154] <... set_robust_list resumed>) = 0 [pid 1153] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1154] rt_sigprocmask(SIG_SETMASK, [], [pid 1153] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1147] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 1156 attached [pid 1154] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1153] <... write resumed>) = 262144 [pid 1156] set_robust_list(0x555556d8d6a0, 24 [pid 1154] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1156] <... set_robust_list resumed>) = 0 [pid 1154] <... open resumed>) = 4 [pid 1156] chdir("./29" [pid 1154] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... chdir resumed>) = 0 [pid 1154] <... futex resumed>) = 1 [pid 1151] <... futex resumed>) = 0 [pid 1156] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1154] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1151] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... prctl resumed>) = 0 [pid 1154] <... mount resumed>) = 0 [pid 1151] <... futex resumed>) = 0 [pid 1156] setpgid(0, 0 [pid 1154] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1156] <... setpgid resumed>) = 0 [pid 1154] <... futex resumed>) = 0 [pid 1153] munmap(0x7f0c41dcd000, 138412032 [pid 1151] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1156] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1154] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1153] <... munmap resumed>) = 0 [pid 1151] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... openat resumed>) = 3 [pid 1154] <... open resumed>) = 5 [pid 1153] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1151] <... futex resumed>) = 0 [pid 1156] write(3, "1000", 4 [pid 1154] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1153] <... openat resumed>) = 6 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1156] <... write resumed>) = 4 [pid 1154] <... futex resumed>) = 0 [pid 1153] ioctl(6, LOOP_SET_FD, 3 [pid 1151] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1156] close(3 [pid 1154] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1151] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... close resumed>) = 0 [pid 1154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1151] <... futex resumed>) = 0 [pid 1156] symlink("/dev/binderfs", "./binderfs" [pid 1154] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1156] <... symlink resumed>) = 0 [pid 1154] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1156] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1154] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... futex resumed>) = 0 [pid 1154] <... futex resumed>) = 1 [pid 1151] <... futex resumed>) = 0 [pid 1156] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1154] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1151] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1151] <... futex resumed>) = 0 [pid 1156] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1154] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1151] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1156] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1154] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1156] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [ 31.165896][ T1137] EXT4-fs (loop1): 1 orphan inode deleted [ 31.181778][ T1137] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/27/file1 supports timestamps until 2038 (0x7fffffff) [ 31.200769][ T1141] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1154] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1154] <... futex resumed>) = 1 [pid 1151] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1150 attached [pid 1156] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1154] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1147] <... write resumed>) = 262144 [pid 1139] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1137] <... mount resumed>) = 0 [pid 1156] <... mprotect resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1139] <... futex resumed>) = 0 [pid 1156] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1139] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1156] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1139] <... mmap resumed>) = 0x7f0c41dac000 [pid 1139] mprotect(0x7f0c41dad000, 131072, PROT_READ|PROT_WRITE [pid 1156] <... clone3 resumed> => {parent_tid=[1157]}, 88) = 1157 [pid 1139] <... mprotect resumed>) = 0 [pid 1156] rt_sigprocmask(SIG_SETMASK, [], [pid 1139] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1156] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1153] <... ioctl resumed>) = 0 [pid 1150] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1147] munmap(0x7f0c41dcd000, 138412032 [pid 1141] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1139] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1137] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1156] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1141] ioctl(4, LOOP_CLR_FD [pid 1139] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41dcc990, parent_tid=0x7f0c41dcc990, exit_signal=0, stack=0x7f0c41dac000, stack_size=0x20300, tls=0x7f0c41dcc6c0} [pid 1156] <... futex resumed>) = 0 [pid 1141] <... ioctl resumed>) = 0 [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1141] close(4 [pid 1139] <... clone3 resumed> => {parent_tid=[1158]}, 88) = 1158 [pid 1156] <... futex resumed>) = 0 [pid 1141] <... close resumed>) = 0 [pid 1139] rt_sigprocmask(SIG_SETMASK, [], [pid 1156] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1141] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1156] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1141] <... futex resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1141] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1139] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1157 attached [pid 1156] <... mprotect resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1157] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1156] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1153] close(3 [pid 1150] <... set_robust_list resumed>) = 0 [pid 1147] <... munmap resumed>) = 0 [pid 1137] <... openat resumed>) = 4 [pid 1157] <... set_robust_list resumed>) = 0 [pid 1156] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1157] rt_sigprocmask(SIG_SETMASK, [], [pid 1156] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1157] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1157] memfd_create("syzkaller", 0 [pid 1156] <... clone3 resumed> => {parent_tid=[1159]}, 88) = 1159 [pid 1157] <... memfd_create resumed>) = 3 [pid 1156] rt_sigprocmask(SIG_SETMASK, [], [pid 1157] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1156] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1157] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1156] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1158 attached [pid 1157] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1156] <... futex resumed>) = 0 [pid 1153] <... close resumed>) = 0 [pid 1150] rt_sigprocmask(SIG_SETMASK, [], [pid 1147] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1137] chdir("./file1" [pid 1158] set_robust_list(0x7f0c41dcc9a0, 24 [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1158] <... set_robust_list resumed>) = 0 [pid 1158] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1158] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 1157] <... write resumed>) = 262144 [pid 1158] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1153] mkdir("./bus", 0777 [pid 1150] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1147] <... openat resumed>) = 4 [pid 1137] <... chdir resumed>) = 0 [pid 1135] exit_group(0./strace-static-x86_64: Process 1159 attached [pid 1157] munmap(0x7f0c41dcd000, 138412032 [pid 1153] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1150] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1147] ioctl(4, LOOP_SET_FD, 3 [pid 1144] <... futex resumed>) = ? [pid 1137] ioctl(6, LOOP_CLR_FD [pid 1135] <... exit_group resumed>) = ? [pid 1159] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1158] <... futex resumed>) = 1 [pid 1157] <... munmap resumed>) = 0 [pid 1153] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1150] <... open resumed>) = 5 [pid 1142] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1141] <... futex resumed>) = ? [pid 1139] <... futex resumed>) = 0 [pid 1158] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1142] ioctl(5, LOOP_CLR_FD [pid 1141] +++ exited with 0 +++ [pid 1139] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1158] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1142] <... ioctl resumed>) = 0 [pid 1139] <... futex resumed>) = 0 [ 31.215142][ T1153] loop0: detected capacity change from 0 to 512 [ 31.217502][ T1141] EXT4-fs (loop5): get root inode failed [ 31.221357][ T1142] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.227152][ T1141] EXT4-fs (loop5): mount failed [ 31.244759][ T1142] EXT4-fs (loop4): get root inode failed [ 31.254985][ T1142] EXT4-fs (loop4): mount failed [pid 1158] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1142] close(5 [pid 1139] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1158] <... open resumed>) = 6 [pid 1144] +++ exited with 0 +++ [pid 1137] <... ioctl resumed>) = 0 [pid 1137] close(6) = 0 [pid 1137] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1137] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1142] <... close resumed>) = 0 [pid 1142] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1136] exit_group(0) = ? [pid 1138] <... futex resumed>) = ? [pid 1137] <... futex resumed>) = ? [pid 1150] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1142] <... futex resumed>) = 0 [pid 1142] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1140] exit_group(0 [pid 1138] +++ exited with 0 +++ [pid 1143] <... futex resumed>) = ? [pid 1142] <... futex resumed>) = ? [pid 1140] <... exit_group resumed>) = ? [pid 1150] <... futex resumed>) = 0 [pid 1143] +++ exited with 0 +++ [pid 1142] +++ exited with 0 +++ [pid 1140] +++ exited with 0 +++ [pid 1137] +++ exited with 0 +++ [pid 1136] +++ exited with 0 +++ [pid 1150] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1140, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1136, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 295] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(3, "", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] getdents64(3, [pid 295] newfstatat(3, "", [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1159] <... set_robust_list resumed>) = 0 [pid 1158] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1157] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1147] <... ioctl resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./27/bus", [pid 295] <... umount2 resumed>) = 0 [pid 1159] rt_sigprocmask(SIG_SETMASK, [], [pid 1158] <... futex resumed>) = 1 [pid 1157] <... openat resumed>) = 4 [pid 1147] close(3 [pid 1139] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1159] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1158] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1157] ioctl(4, LOOP_SET_FD, 3 [pid 1147] <... close resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./27/bus" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1159] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1150] <... futex resumed>) = 0 [pid 1139] <... futex resumed>) = 1 [pid 298] <... unlink resumed>) = 0 [pid 1150] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1139] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./27/bus", [pid 1159] <... open resumed>) = 5 [pid 1147] mkdir("./bus", 0777 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1159] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1147] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] newfstatat(AT_FDCWD, "./27/binderfs", [pid 295] unlink("./27/bus" [pid 1159] <... futex resumed>) = 1 [pid 1156] <... futex resumed>) = 0 [pid 1147] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1159] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1156] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./27/binderfs" [pid 295] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1159] <... mount resumed>) = 0 [pid 1156] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1159] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 295] newfstatat(AT_FDCWD, "./27/binderfs", [pid 1159] <... futex resumed>) = 0 [pid 1156] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1159] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1156] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 295] unlink("./27/binderfs" [pid 1159] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1156] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1159] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] rmdir("./27" [pid 295] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./28", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1157] <... ioctl resumed>) = 0 [pid 1157] close(3) = 0 [pid 1157] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1157] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1159] <... open resumed>) = 6 [pid 1159] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1156] <... futex resumed>) = 0 [pid 1156] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1159] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1156] <... futex resumed>) = 0 [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1159] <... write resumed>) = 8 [pid 1159] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1156] <... futex resumed>) = 0 [pid 1159] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1156] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1159] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1156] <... futex resumed>) = 0 [pid 1159] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1150] <... write resumed>) = 8 [pid 1156] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1150] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1159] <... write resumed>) = 1045 [pid 1150] <... futex resumed>) = 1 [pid 1139] <... futex resumed>) = 0 [pid 1159] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1150] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1139] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1150] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1139] <... futex resumed>) = 0 [pid 1159] <... futex resumed>) = 1 [pid 1159] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1150] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1156] <... futex resumed>) = 0 [pid 1139] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1135] +++ exited with 0 +++ [pid 298] <... openat resumed>) = 3 [ 31.261704][ T1147] loop3: detected capacity change from 0 to 512 [ 31.277958][ T1157] loop2: detected capacity change from 0 to 512 [ 31.292356][ T1157] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.293696][ T1153] EXT4-fs (loop0): 1 orphan inode deleted [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1135, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = 0 [pid 299] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1139] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] close(3 [pid 299] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(3, "", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1166 [pid 295] newfstatat(AT_FDCWD, "./27/file1", [pid 299] getdents64(3, [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1150] <... write resumed>) = 1045 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1150] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 [pid 295] getdents64(4, ./strace-static-x86_64: Process 1166 attached [pid 1150] <... futex resumed>) = 0 [pid 299] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1150] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(4 [pid 299] newfstatat(AT_FDCWD, "./30/bus", [pid 295] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] rmdir("./27/file1" [pid 299] unlink("./30/bus" [pid 295] <... rmdir resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 295] getdents64(3, [pid 299] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 299] newfstatat(AT_FDCWD, "./30/binderfs", [pid 295] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] rmdir("./27" [pid 299] unlink("./30/binderfs" [pid 295] <... rmdir resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 295] mkdir("./28", 0777 [pid 299] getdents64(3, [pid 295] <... mkdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] close(3 [pid 295] <... openat resumed>) = 3 [pid 299] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] rmdir("./30" [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 299] mkdir("./31", 0777 [pid 295] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1166] set_robust_list(0x555556d8d6a0, 24 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1166] <... set_robust_list resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1167 [pid 1166] chdir("./28" [pid 299] ioctl(3, LOOP_CLR_FD [pid 1166] <... chdir resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1166] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] close(3 [pid 1166] <... prctl resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 1166] setpgid(0, 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1166] <... setpgid resumed>) = 0 [pid 1166] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1168 [pid 1166] <... openat resumed>) = 3 [pid 1166] write(3, "1000", 4) = 4 ./strace-static-x86_64: Process 1167 attached [pid 1166] close(3 [pid 1167] set_robust_list(0x555556d8d6a0, 24 [pid 1166] <... close resumed>) = 0 [pid 1167] <... set_robust_list resumed>) = 0 [pid 1166] symlink("/dev/binderfs", "./binderfs" [pid 1167] chdir("./28" [pid 1166] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 1168 attached [pid 1167] <... chdir resumed>) = 0 [pid 1166] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1166] <... futex resumed>) = 0 [pid 1168] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1167] <... prctl resumed>) = 0 [pid 1166] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1168] chdir("./31" [pid 1167] setpgid(0, 0 [pid 1166] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1166] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1167] <... setpgid resumed>) = 0 [pid 1166] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1168] <... chdir resumed>) = 0 [pid 1167] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1166] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1168] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1166] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1166] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1168] <... prctl resumed>) = 0 [pid 1166] <... mprotect resumed>) = 0 [pid 1167] <... openat resumed>) = 3 [pid 1167] write(3, "1000", 4 [pid 1166] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1167] <... write resumed>) = 4 [pid 1168] setpgid(0, 0 [pid 1167] close(3 [pid 1166] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1168] <... setpgid resumed>) = 0 [pid 1168] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1167] <... close resumed>) = 0 [pid 1166] <... clone3 resumed> => {parent_tid=[1169]}, 88) = 1169 [pid 1167] symlink("/dev/binderfs", "./binderfs" [pid 1166] rt_sigprocmask(SIG_SETMASK, [], [pid 1168] write(3, "1000", 4) = 4 [pid 1168] close(3) = 0 [pid 1166] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1168] symlink("/dev/binderfs", "./binderfs" [pid 1166] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1168] <... symlink resumed>) = 0 [pid 1167] <... symlink resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1168] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1168] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1168] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1167] <... futex resumed>) = 0 [pid 1166] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1168] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1168] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1166] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1167] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1168] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1168] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1167] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1166] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1168] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1167] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1166] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 1169 attached [pid 1168] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1168] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1166] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1168] <... clone3 resumed> => {parent_tid=[1170]}, 88) = 1170 [pid 1166] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1167] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1168] rt_sigprocmask(SIG_SETMASK, [], [pid 1166] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1168] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1167] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1168] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1166] <... clone3 resumed> => {parent_tid=[1171]}, 88) = 1171 [pid 1168] <... futex resumed>) = 0 [pid 1167] <... mprotect resumed>) = 0 [pid 1166] rt_sigprocmask(SIG_SETMASK, [], [pid 1168] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1166] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1168] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1168] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1167] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1166] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1168] <... mprotect resumed>) = 0 [pid 1167] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1168] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1168] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1167] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1168] <... clone3 resumed> => {parent_tid=[1172]}, 88) = 1172 [pid 1168] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1168] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] <... clone3 resumed> => {parent_tid=[1173]}, 88) = 1173 [pid 1168] <... futex resumed>) = 0 [pid 1167] rt_sigprocmask(SIG_SETMASK, [], [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1167] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1169] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1167] <... futex resumed>) = 0 [pid 1167] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1169] <... set_robust_list resumed>) = 0 [pid 1167] <... futex resumed>) = 0 [pid 1167] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1169] rt_sigprocmask(SIG_SETMASK, [], [pid 1167] <... mmap resumed>) = 0x7f0c4a1cd000 ./strace-static-x86_64: Process 1173 attached [pid 1169] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1167] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1173] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1167] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1173] rt_sigprocmask(SIG_SETMASK, [], [pid 1169] memfd_create("syzkaller", 0 [pid 1167] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1173] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1167] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1169] <... memfd_create resumed>) = 3 [pid 1173] memfd_create("syzkaller", 0 [pid 1169] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1167] <... clone3 resumed> => {parent_tid=[1174]}, 88) = 1174 [pid 1169] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1167] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1173] <... memfd_create resumed>) = 3 [pid 1167] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1167] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1173] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1173] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1169] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 1172 attached ./strace-static-x86_64: Process 1171 attached ./strace-static-x86_64: Process 1170 attached [pid 1173] <... write resumed>) = 262144 [pid 1157] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1169] <... write resumed>) = 262144 [pid 1173] munmap(0x7f0c41dcd000, 138412032 [pid 1172] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1171] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1170] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1157] ioctl(4, LOOP_CLR_FD [pid 1173] <... munmap resumed>) = 0 [pid 1172] <... set_robust_list resumed>) = 0 [pid 1171] <... set_robust_list resumed>) = 0 [pid 1170] <... set_robust_list resumed>) = 0 [pid 1173] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1172] rt_sigprocmask(SIG_SETMASK, [], [pid 1171] rt_sigprocmask(SIG_SETMASK, [], [pid 1170] rt_sigprocmask(SIG_SETMASK, [], [pid 1173] <... openat resumed>) = 4 [pid 1172] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1171] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1170] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1157] <... ioctl resumed>) = 0 [ 31.312112][ T1153] ext4 filesystem being mounted at /root/syzkaller.iF59aB/29/bus supports timestamps until 2038 (0x7fffffff) [ 31.312546][ T1157] EXT4-fs (loop2): get root inode failed [ 31.330420][ T1147] EXT4-fs (loop3): 1 orphan inode deleted [ 31.336031][ T1147] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/28/bus supports timestamps until 2038 (0x7fffffff) [ 31.347671][ T1157] EXT4-fs (loop2): mount failed [pid 1173] ioctl(4, LOOP_SET_FD, 3 [pid 1172] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1171] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1170] memfd_create("syzkaller", 0 [pid 1157] close(4./strace-static-x86_64: Process 1174 attached [pid 1169] munmap(0x7f0c41dcd000, 138412032 [pid 1157] <... close resumed>) = 0 [pid 1174] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1169] <... munmap resumed>) = 0 [pid 1157] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1156] exit_group(0 [pid 1174] <... set_robust_list resumed>) = 0 [pid 1169] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1159] <... futex resumed>) = ? [pid 1157] <... futex resumed>) = ? [pid 1156] <... exit_group resumed>) = ? [pid 1174] rt_sigprocmask(SIG_SETMASK, [], [pid 1169] <... openat resumed>) = 4 [pid 1159] +++ exited with 0 +++ [pid 1157] +++ exited with 0 +++ [pid 1174] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1169] ioctl(4, LOOP_SET_FD, 3 [pid 1174] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1173] <... ioctl resumed>) = 0 [pid 1172] <... open resumed>) = 4 [pid 1171] <... open resumed>) = 5 [pid 1170] <... memfd_create resumed>) = 3 [pid 1173] close(3 [pid 1172] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1171] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1170] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1173] <... close resumed>) = 0 [pid 1172] <... futex resumed>) = 1 [pid 1171] <... futex resumed>) = 1 [pid 1170] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1168] <... futex resumed>) = 0 [pid 1173] mkdir("./bus", 0777 [pid 1172] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1171] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1170] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1168] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1173] <... mkdir resumed>) = 0 [pid 1172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1170] <... write resumed>) = 262144 [pid 1168] <... futex resumed>) = 0 [pid 1173] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1172] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1170] munmap(0x7f0c41dcd000, 138412032 [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1172] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1170] <... munmap resumed>) = 0 [pid 1172] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1170] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1172] <... futex resumed>) = 1 [pid 1170] <... openat resumed>) = 5 [pid 1168] <... futex resumed>) = 0 [pid 1172] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1170] ioctl(5, LOOP_SET_FD, 3 [pid 1168] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1174] <... open resumed>) = -1 EISDIR (Is a directory) [pid 1172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1170] <... ioctl resumed>) = 0 [pid 1169] <... ioctl resumed>) = 0 [pid 1168] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1153] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1147] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1174] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1169] close(3 [pid 1166] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1153] ioctl(6, LOOP_CLR_FD [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1147] ioctl(4, LOOP_CLR_FD [pid 1172] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1170] close(3 [pid 1174] <... futex resumed>) = 1 [pid 1172] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1171] <... futex resumed>) = 0 [pid 1170] <... close resumed>) = 0 [pid 1169] <... close resumed>) = 0 [pid 1167] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 1 [pid 1153] <... ioctl resumed>) = 0 [pid 1174] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1172] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1171] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1170] mkdir("./file1", 0777 [pid 1169] mkdir("./bus", 0777 [pid 1167] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1153] close(6 [pid 1174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1172] <... futex resumed>) = 1 [pid 1171] <... mount resumed>) = 0 [pid 1170] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1169] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1168] <... futex resumed>) = 0 [pid 1167] <... futex resumed>) = 0 [pid 1153] <... close resumed>) = 0 [pid 1174] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1172] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1171] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1169] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1168] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1153] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1151] exit_group(0 [pid 1170] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1174] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1172] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1171] <... futex resumed>) = 1 [pid 1168] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1154] <... futex resumed>) = ? [pid 1153] <... futex resumed>) = ? [pid 1151] <... exit_group resumed>) = ? [pid 1174] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1172] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1171] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1166] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1154] +++ exited with 0 +++ [pid 1153] +++ exited with 0 +++ [pid 1174] <... futex resumed>) = 1 [pid 1172] <... futex resumed>) = 0 [pid 1171] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1168] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1167] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 1174] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1172] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1171] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1167] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1156] +++ exited with 0 +++ [pid 1151] +++ exited with 0 +++ [pid 1147] <... ioctl resumed>) = 0 [pid 1171] <... open resumed>) = 3 [pid 1168] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] <... futex resumed>) = 0 [pid 1147] close(4 [pid 1174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1172] <... futex resumed>) = 0 [pid 1171] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1168] <... futex resumed>) = 1 [pid 1167] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1147] <... close resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1156, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1151, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1174] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1172] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1171] <... futex resumed>) = 1 [pid 1168] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1166] <... futex resumed>) = 0 [pid 1147] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1171] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1166] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1147] <... futex resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 1171] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1166] <... futex resumed>) = 0 [pid 1147] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1139] exit_group(0 [pid 1171] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1158] <... futex resumed>) = ? [pid 1150] <... futex resumed>) = ? [pid 1147] <... futex resumed>) = ? [pid 1139] <... exit_group resumed>) = ? [pid 1171] <... write resumed>) = 8 [pid 1158] +++ exited with 0 +++ [pid 1150] +++ exited with 0 +++ [pid 1147] +++ exited with 0 +++ [pid 1139] +++ exited with 0 +++ [pid 1174] <... open resumed>) = -1 EISDIR (Is a directory) [pid 1172] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 296] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1174] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1172] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1171] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1139, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1174] <... futex resumed>) = 1 [pid 1172] <... futex resumed>) = 1 [pid 1171] <... futex resumed>) = 1 [pid 1168] <... futex resumed>) = 0 [pid 1167] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1174] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1172] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1171] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1167] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1166] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... restart_syscall resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 1174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1171] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1167] <... futex resumed>) = 0 [pid 1166] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 1174] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1171] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1167] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1166] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1174] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1171] <... write resumed>) = 1045 [pid 297] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 294] getdents64(3, [pid 1171] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1171] <... futex resumed>) = 1 [ 31.391874][ T1173] loop1: detected capacity change from 0 to 512 [ 31.396861][ T1169] loop4: detected capacity change from 0 to 512 [ 31.403995][ T1170] loop5: detected capacity change from 0 to 512 [ 31.426781][ T1173] EXT4-fs (loop1): 1 orphan inode deleted [pid 1166] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1174] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1173] <... mount resumed>) = 0 [pid 1171] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1173] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 1173] chdir("./bus") = 0 [pid 1173] ioctl(4, LOOP_CLR_FD) = 0 [pid 1173] close(4) = 0 [pid 1173] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1174] <... futex resumed>) = 1 [pid 1173] <... futex resumed>) = 0 [pid 1167] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [ 31.439247][ T1173] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/28/bus supports timestamps until 2038 (0x7fffffff) [ 31.444000][ T1170] EXT4-fs (loop5): 1 orphan inode deleted [ 31.457153][ T1169] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.462698][ T1170] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/31/file1 supports timestamps until 2038 (0x7fffffff) [ 31.470574][ T1169] EXT4-fs (loop4): get root inode failed [pid 1173] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1174] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1167] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(3, "", [pid 296] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1167] <... futex resumed>) = 1 [pid 1173] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1173] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1173] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1167] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] newfstatat(AT_FDCWD, "./29/bus", [pid 294] newfstatat(AT_FDCWD, "./29/bus", [pid 1173] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1167] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] getdents64(3, [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1173] <... futex resumed>) = 0 [pid 1167] exit_group(0 [pid 1174] <... futex resumed>) = ? [pid 1167] <... exit_group resumed>) = ? [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] unlink("./29/bus" [pid 294] unlink("./29/bus" [pid 1174] +++ exited with 0 +++ [pid 1173] +++ exited with 0 +++ [pid 296] <... unlink resumed>) = 0 [pid 1167] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1167, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] <... unlink resumed>) = 0 [pid 297] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./28/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./29/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./29/binderfs", [pid 297] unlink("./28/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./29/binderfs" [pid 297] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./29/binderfs" [pid 294] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 296] getdents64(3, [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./28/binderfs", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] unlink("./28/binderfs" [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 295] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] rmdir("./29" [pid 295] <... openat resumed>) = 3 [pid 294] rmdir("./29" [pid 297] getdents64(3, [pid 296] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 1169] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] mkdir("./30", 0777 [pid 295] newfstatat(3, "", [pid 294] mkdir("./30", 0777 [pid 297] close(3 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] getdents64(3, [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] rmdir("./28" [pid 296] <... openat resumed>) = 3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... openat resumed>) = 3 [pid 297] <... rmdir resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] ioctl(3, LOOP_CLR_FD [pid 297] mkdir("./29", 0777 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... mkdir resumed>) = 0 [pid 296] close(3 [pid 294] close(3 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1181 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1182 [pid 297] close(3) = 0 [pid 1170] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1170] ioctl(5, LOOP_CLR_FD [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1183 [pid 1169] ioctl(4, LOOP_CLR_FD) = 0 [pid 1169] close(4./strace-static-x86_64: Process 1183 attached ) = 0 [pid 1183] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1183] chdir("./29" [pid 1169] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1169] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1166] exit_group(0 [pid 1171] <... futex resumed>) = ? [pid 1169] <... futex resumed>) = ? [pid 1166] <... exit_group resumed>) = ? [pid 1171] +++ exited with 0 +++ [pid 1183] <... chdir resumed>) = 0 [pid 1183] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1183] setpgid(0, 0) = 0 [pid 1183] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1183] write(3, "1000", 4) = 4 [pid 1183] close(3) = 0 [pid 1183] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1183] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1183] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1183] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1183] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 1181 attached ./strace-static-x86_64: Process 1182 attached ) = 0x7f0c4a1ee000 [pid 1182] set_robust_list(0x555556d8d6a0, 24 [pid 1183] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1183] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1182] <... set_robust_list resumed>) = 0 [pid 1181] set_robust_list(0x555556d8d6a0, 24 [pid 1183] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1183] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1181] <... set_robust_list resumed>) = 0 [pid 1182] chdir("./30") = 0 [pid 1181] chdir("./30") = 0 [pid 1182] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1181] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1183] <... clone3 resumed> => {parent_tid=[1184]}, 88) = 1184 [pid 1183] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1183] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... prctl resumed>) = 0 [pid 1183] <... futex resumed>) = 0 [pid 1181] setpgid(0, 0 [pid 1182] setpgid(0, 0 [pid 1181] <... setpgid resumed>) = 0 [pid 1182] <... setpgid resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1182] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1181] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1183] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1183] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1183] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1183] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1182] <... openat resumed>) = 3 [pid 1181] <... openat resumed>) = 3 [pid 1183] <... clone3 resumed> => {parent_tid=[1185]}, 88) = 1185 [pid 1182] write(3, "1000", 4 [pid 1181] write(3, "1000", 4 [pid 1183] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1182] <... write resumed>) = 4 [pid 1181] <... write resumed>) = 4 [pid 1183] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1182] close(3 [pid 1181] close(3 [pid 1183] <... futex resumed>) = 0 [pid 1182] <... close resumed>) = 0 [pid 1181] <... close resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1182] symlink("/dev/binderfs", "./binderfs" [pid 1181] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 1185 attached [pid 1185] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1185] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1185] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1181] <... symlink resumed>) = 0 [pid 1185] <... open resumed>) = 3 [pid 1182] <... symlink resumed>) = 0 [pid 1182] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1185] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1183] <... futex resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1185] <... futex resumed>) = 1 [pid 1185] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1185] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1183] <... futex resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1185] <... futex resumed>) = 1 [pid 1185] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1185] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1183] <... futex resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1185] <... futex resumed>) = 1 [pid 1185] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1185] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1183] <... futex resumed>) = 0 [pid 1182] <... futex resumed>) = 0 [pid 1181] <... futex resumed>) = 0 [pid 1183] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1182] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, ./strace-static-x86_64: Process 1184 attached [pid 1185] <... futex resumed>) = 1 [pid 1183] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1181] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1182] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1181] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1182] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1182] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1182] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1181] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1185] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1184] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1185] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1184] <... set_robust_list resumed>) = 0 [pid 1182] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1182] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1181] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1185] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1184] rt_sigprocmask(SIG_SETMASK, [], [pid 1182] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1181] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1181] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1182] <... clone3 resumed> => {parent_tid=[1186]}, 88) = 1186 [pid 1181] <... mprotect resumed>) = 0 [pid 1182] rt_sigprocmask(SIG_SETMASK, [], [pid 1181] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1182] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1181] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1182] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1182] <... futex resumed>) = 0 [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... clone3 resumed> => {parent_tid=[1187]}, 88) = 1187 [pid 1182] <... futex resumed>) = 0 [pid 1181] rt_sigprocmask(SIG_SETMASK, [], [pid 1182] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1182] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1181] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1182] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1181] <... futex resumed>) = 0 [pid 1182] <... mprotect resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1182] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1181] <... futex resumed>) = 0 [pid 1182] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1181] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... umount2 resumed>) = 0 [pid 1182] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1181] <... mmap resumed>) = 0x7f0c4a1cd000 ./strace-static-x86_64: Process 1188 attached ./strace-static-x86_64: Process 1187 attached ./strace-static-x86_64: Process 1186 attached [pid 1185] <... futex resumed>) = 1 [pid 1184] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1183] <... futex resumed>) = 0 [ 31.488243][ T1169] EXT4-fs (loop4): mount failed [pid 1170] <... ioctl resumed>) = 0 [pid 1169] +++ exited with 0 +++ [pid 1166] +++ exited with 0 +++ [pid 295] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1188] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1187] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1186] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1185] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1184] memfd_create("syzkaller", 0 [pid 1181] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1170] close(5 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1166, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1188] <... set_robust_list resumed>) = 0 [pid 1187] <... set_robust_list resumed>) = 0 [pid 1186] <... set_robust_list resumed>) = 0 [pid 1184] <... memfd_create resumed>) = 5 [pid 1182] <... clone3 resumed> => {parent_tid=[1188]}, 88) = 1188 [pid 1170] <... close resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./28/bus", [pid 1188] rt_sigprocmask(SIG_SETMASK, [], [pid 1187] rt_sigprocmask(SIG_SETMASK, [], [pid 1186] rt_sigprocmask(SIG_SETMASK, [], [pid 1184] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1182] rt_sigprocmask(SIG_SETMASK, [], [pid 1181] <... mprotect resumed>) = 0 [pid 1170] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1168] exit_group(0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1188] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1187] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1186] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1184] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1181] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1172] <... futex resumed>) = ? [pid 1170] <... futex resumed>) = ? [pid 1168] <... exit_group resumed>) = ? [pid 298] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1187] memfd_create("syzkaller", 0 [pid 1186] memfd_create("syzkaller", 0 [pid 1184] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1182] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1181] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1172] +++ exited with 0 +++ [pid 1170] +++ exited with 0 +++ [pid 1168] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1187] <... memfd_create resumed>) = 3 [pid 1186] <... memfd_create resumed>) = 3 [pid 1184] <... write resumed>) = 262144 [pid 1182] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1168, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./28/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1188] <... futex resumed>) = 0 [pid 1187] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1186] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1184] munmap(0x7f0c41dcd000, 138412032 [pid 1182] <... futex resumed>) = 1 [pid 298] <... openat resumed>) = 3 [pid 1188] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1186] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1181] <... clone3 resumed> => {parent_tid=[1189]}, 88) = 1189 [pid 295] <... openat resumed>) = 4 [pid 1188] <... open resumed>) = 4 [pid 1187] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1184] <... munmap resumed>) = 0 [pid 1181] rt_sigprocmask(SIG_SETMASK, [], [pid 298] newfstatat(3, "", [pid 1188] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1188] <... futex resumed>) = 1 [pid 1182] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1182] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1182] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1188] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1188] <... mount resumed>) = 0 [pid 1188] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1182] <... futex resumed>) = 0 [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1182] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1182] <... futex resumed>) = 0 [pid 1188] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1188] <... open resumed>) = 5 [pid 1186] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 295] newfstatat(4, "", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1188] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1184] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 299] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1188] <... futex resumed>) = 1 [pid 1182] <... futex resumed>) = 0 [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1182] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1182] <... futex resumed>) = 0 [pid 1188] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1188] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1188] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1182] <... futex resumed>) = 0 [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1182] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1182] <... futex resumed>) = 0 [pid 1188] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1182] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1188] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 295] getdents64(4, [pid 1188] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 1188] <... futex resumed>) = 1 [pid 1184] <... openat resumed>) = 6 [pid 1182] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1188] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1184] ioctl(6, LOOP_SET_FD, 5 [pid 1186] <... write resumed>) = 262144 [pid 295] getdents64(4, [pid 299] newfstatat(3, "", [pid 298] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1189 attached [pid 1189] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1189] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1189] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1189] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1189] <... futex resumed>) = 1 [pid 1189] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1189] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1189] <... futex resumed>) = 1 [pid 1189] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1189] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1189] <... futex resumed>) = 1 [pid 1189] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1189] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1181] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1181] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1189] <... futex resumed>) = 1 [pid 1189] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 1189] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1181] <... futex resumed>) = 0 [pid 1189] <... futex resumed>) = 1 [pid 1189] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1187] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1187] munmap(0x7f0c41dcd000, 138412032 [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 295] close(4 [pid 1186] munmap(0x7f0c41dcd000, 138412032 [pid 299] getdents64(3, [pid 298] umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 1186] <... munmap resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1186] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1184] <... ioctl resumed>) = 0 [pid 299] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1187] <... munmap resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./28/bus", [pid 295] rmdir("./28/bus" [pid 1186] <... openat resumed>) = 6 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1184] close(5) = 0 [pid 1184] mkdir("./file1", 0777 [pid 1186] ioctl(6, LOOP_SET_FD, 3 [pid 299] newfstatat(AT_FDCWD, "./31/binderfs", [pid 298] unlink("./28/bus" [pid 295] <... rmdir resumed>) = 0 [pid 1184] <... mkdir resumed>) = 0 [pid 1184] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1186] <... ioctl resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... unlink resumed>) = 0 [pid 299] unlink("./31/binderfs" [pid 298] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./28/binderfs", [pid 295] newfstatat(AT_FDCWD, "./28/binderfs", [pid 299] newfstatat(AT_FDCWD, "./31/file1", [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./28/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./31/file1" [pid 298] <... unlink resumed>) = 0 [pid 295] unlink("./28/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 1187] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 299] getdents64(3, [pid 295] getdents64(3, [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 298] close(3 [pid 295] close(3 [pid 1187] <... openat resumed>) = 6 [pid 299] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 1187] ioctl(6, LOOP_SET_FD, 3 [pid 299] rmdir("./31" [pid 298] rmdir("./28" [pid 295] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 295] rmdir("./28" [pid 298] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 298] mkdir("./29", 0777 [pid 299] mkdir("./32", 0777 [pid 295] mkdir("./29", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 1186] close(3) = 0 [pid 1186] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 299] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1186] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 298] close(3 [pid 295] close(3 [pid 299] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 1191 attached [pid 1187] <... ioctl resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1191] set_robust_list(0x555556d8d6a0, 24 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1191 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1192 [pid 1191] <... set_robust_list resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1193 [pid 1191] chdir("./32") = 0 [pid 1191] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1191] setpgid(0, 0) = 0 [pid 1191] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1187] close(3 [pid 1191] write(3, "1000", 4 [pid 1187] <... close resumed>) = 0 [pid 1191] <... write resumed>) = 4 [pid 1187] mkdir("./bus", 0777 [pid 1191] close(3 [pid 1187] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1191] <... close resumed>) = 0 [pid 1187] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1191] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1191] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1191] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1191] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1191] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1191] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1191] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1191] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1195]}, 88) = 1195 [pid 1191] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1191] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 1195 attached ./strace-static-x86_64: Process 1193 attached ./strace-static-x86_64: Process 1192 attached [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1195] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1193] set_robust_list(0x555556d8d6a0, 24 [pid 1192] set_robust_list(0x555556d8d6a0, 24 [pid 1191] <... futex resumed>) = 0 [pid 1191] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1191] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1191] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1191] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1197]}, 88) = 1197 [pid 1191] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1191] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1195] <... set_robust_list resumed>) = 0 [pid 1195] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1195] memfd_create("syzkaller", 0 [pid 1193] <... set_robust_list resumed>) = 0 [ 31.553560][ T1184] loop3: detected capacity change from 0 to 512 [ 31.561655][ T1186] loop0: detected capacity change from 0 to 512 [ 31.572944][ T1187] loop2: detected capacity change from 0 to 512 [ 31.597151][ T1184] EXT4-fs (loop3): 1 orphan inode deleted [pid 1192] <... set_robust_list resumed>) = 0 [pid 1195] <... memfd_create resumed>) = 3 [pid 1195] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1195] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1195] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1195] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 1195] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1197 attached [pid 1193] chdir("./29" [pid 1192] chdir("./29" [pid 1184] <... mount resumed>) = 0 [pid 1197] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1193] <... chdir resumed>) = 0 [pid 1192] <... chdir resumed>) = 0 [pid 1197] <... set_robust_list resumed>) = 0 [pid 1193] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1192] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1184] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1197] rt_sigprocmask(SIG_SETMASK, [], [pid 1193] <... prctl resumed>) = 0 [pid 1192] <... prctl resumed>) = 0 [pid 1197] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1193] setpgid(0, 0 [pid 1192] setpgid(0, 0 [pid 1184] <... openat resumed>) = 5 [pid 1197] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1193] <... setpgid resumed>) = 0 [pid 1192] <... setpgid resumed>) = 0 [pid 1197] <... open resumed>) = 5 [pid 1193] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1192] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1184] chdir("./file1" [pid 1197] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] <... openat resumed>) = 3 [pid 1192] <... openat resumed>) = 3 [pid 1197] <... futex resumed>) = 1 [pid 1193] write(3, "1000", 4 [pid 1192] write(3, "1000", 4 [pid 1191] <... futex resumed>) = 0 [pid 1184] <... chdir resumed>) = 0 [pid 1197] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1193] <... write resumed>) = 4 [pid 1192] <... write resumed>) = 4 [pid 1191] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1197] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1193] close(3 [pid 1192] close(3 [pid 1191] <... futex resumed>) = 0 [pid 1184] ioctl(6, LOOP_CLR_FD [pid 1197] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1195] <... ioctl resumed>) = 0 [pid 1193] <... close resumed>) = 0 [pid 1192] <... close resumed>) = 0 [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1195] close(3 [pid 1197] <... mount resumed>) = 0 [pid 1193] symlink("/dev/binderfs", "./binderfs" [pid 1192] symlink("/dev/binderfs", "./binderfs" [pid 1195] <... close resumed>) = 0 [pid 1195] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1192] <... symlink resumed>) = 0 [pid 1195] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1197] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] <... symlink resumed>) = 0 [pid 1197] <... futex resumed>) = 1 [pid 1191] <... futex resumed>) = 0 [pid 1197] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1193] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1197] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1192] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1191] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] <... futex resumed>) = 0 [pid 1197] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1192] <... futex resumed>) = 0 [pid 1184] <... ioctl resumed>) = 0 [pid 1184] close(6) = 0 [pid 1184] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1184] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1197] <... open resumed>) = 3 [pid 1193] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1192] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1191] <... futex resumed>) = 0 [pid 1183] exit_group(0 [pid 1197] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1185] <... futex resumed>) = ? [pid 1183] <... exit_group resumed>) = ? [pid 1197] <... futex resumed>) = 0 [pid 1193] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1192] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1191] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1185] +++ exited with 0 +++ [pid 1184] <... futex resumed>) = ? [pid 1197] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1193] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1192] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [ 31.603410][ T1184] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/29/file1 supports timestamps until 2038 (0x7fffffff) [ 31.611546][ T1195] loop5: detected capacity change from 0 to 512 [ 31.625196][ T1187] EXT4-fs (loop2): 1 orphan inode deleted [ 31.631056][ T1186] EXT4-fs (loop0): 1 orphan inode deleted [ 31.638254][ T1186] ext4 filesystem being mounted at /root/syzkaller.iF59aB/30/bus supports timestamps until 2038 (0x7fffffff) [pid 1191] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1197] <... write resumed>) = 8 [pid 1193] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1192] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1191] <... futex resumed>) = 0 [pid 1184] +++ exited with 0 +++ [pid 1183] +++ exited with 0 +++ [pid 1197] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1186] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1183, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1197] <... futex resumed>) = 0 [pid 1193] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1197] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1193] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1192] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1191] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1186] ioctl(6, LOOP_CLR_FD [pid 1193] <... mprotect resumed>) = 0 [pid 1191] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1186] <... ioctl resumed>) = 0 [pid 1197] <... futex resumed>) = 0 [pid 1193] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1192] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1191] <... futex resumed>) = 1 [pid 1186] close(6 [pid 297] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1197] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1193] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1192] <... mprotect resumed>) = 0 [pid 1191] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1186] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1193] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1186] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1182] exit_group(0 [pid 297] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1188] <... futex resumed>) = ? [pid 1186] <... futex resumed>) = ? [pid 1182] <... exit_group resumed>) = ? [pid 297] <... openat resumed>) = 3 [pid 1193] <... clone3 resumed> => {parent_tid=[1204]}, 88) = 1204 [pid 1188] +++ exited with 0 +++ [pid 1186] +++ exited with 0 +++ [pid 297] newfstatat(3, "", [pid 1193] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1193] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] getdents64(3, [pid 1193] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1197] <... write resumed>) = 1045 [pid 1193] <... futex resumed>) = 0 [pid 297] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 1193] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1193] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1193] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] newfstatat(AT_FDCWD, "./29/bus", [pid 1193] <... mprotect resumed>) = 0 [pid 1197] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1192] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1193] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] unlink("./29/bus" [pid 1193] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... unlink resumed>) = 0 [pid 1193] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1193] <... clone3 resumed> => {parent_tid=[1205]}, 88) = 1205 [pid 297] newfstatat(AT_FDCWD, "./29/binderfs", [pid 1193] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1193] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] unlink("./29/binderfs" [pid 1193] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 1193] <... futex resumed>) = 0 [pid 297] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1204 attached [pid 1204] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1204] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1204] memfd_create("syzkaller", 0) = 3 [pid 1204] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1204] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1204] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1204] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 1204] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1205 attached [pid 1197] <... futex resumed>) = 1 [pid 1192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1191] <... futex resumed>) = 0 [pid 1204] <... ioctl resumed>) = 0 [pid 1204] close(3) = 0 [pid 1204] mkdir("./file1", 0777) = 0 [pid 1204] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1205] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1205] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1205] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1205] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1193] <... futex resumed>) = 0 [pid 1193] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1205] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1193] <... futex resumed>) = 0 [pid 1205] <... mount resumed>) = 0 [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1205] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1193] <... futex resumed>) = 0 [pid 1205] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1193] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1205] <... open resumed>) = 5 [pid 1193] <... futex resumed>) = 0 [pid 1205] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1205] <... futex resumed>) = 0 [pid 1193] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1205] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1193] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1205] <... write resumed>) = 8 [pid 1193] <... futex resumed>) = 0 [pid 1205] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1205] <... futex resumed>) = 0 [pid 1193] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1205] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1193] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1205] <... write resumed>) = 1045 [pid 1193] <... futex resumed>) = 0 [pid 1205] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1193] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1205] <... futex resumed>) = 0 [pid 1193] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1205] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1197] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1192] <... clone3 resumed> => {parent_tid=[1206]}, 88) = 1206 [pid 1192] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1192] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1192] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1192] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1207]}, 88) = 1207 [pid 1192] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1192] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1207 attached ./strace-static-x86_64: Process 1206 attached [pid 1187] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1187] ioctl(6, LOOP_CLR_FD) = 0 [pid 1187] close(6) = 0 [pid 1187] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1187] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1207] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1207] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 31.640506][ T1187] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/30/bus supports timestamps until 2038 (0x7fffffff) [ 31.670319][ T1195] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.679747][ T1204] loop4: detected capacity change from 0 to 512 [ 31.685363][ T1195] EXT4-fs error (device loop5): ext4_quota_enable:6369: comm syz-executor170: Bad quota inode: 3, type: 0 [pid 1207] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1207] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] <... futex resumed>) = 0 [pid 1192] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1207] <... futex resumed>) = 1 [pid 1207] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1207] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] <... futex resumed>) = 0 [pid 1192] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1207] <... futex resumed>) = 1 [pid 1207] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1207] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] <... futex resumed>) = 0 [pid 1192] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1207] <... futex resumed>) = 1 [pid 1207] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1207] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] <... futex resumed>) = 0 [pid 1192] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1182] +++ exited with 0 +++ [pid 1192] <... futex resumed>) = 0 [pid 1192] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1207] <... futex resumed>) = 1 [pid 1207] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 1207] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1192] <... futex resumed>) = 0 [pid 1207] <... futex resumed>) = 1 [pid 1207] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1206] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1206] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1206] memfd_create("syzkaller", 0) = 5 [pid 1206] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1206] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1206] munmap(0x7f0c41dcd000, 138412032 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1182, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1206] <... munmap resumed>) = 0 [pid 1181] exit_group(0 [pid 294] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1206] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1189] <... futex resumed>) = ? [pid 1187] <... futex resumed>) = ? [pid 1181] <... exit_group resumed>) = ? [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1206] <... openat resumed>) = 6 [pid 1189] +++ exited with 0 +++ [pid 1187] +++ exited with 0 +++ [pid 294] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1206] ioctl(6, LOOP_SET_FD, 5 [pid 294] <... openat resumed>) = 3 [pid 1206] <... ioctl resumed>) = 0 [pid 294] newfstatat(3, "", [pid 1206] close(5 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1206] <... close resumed>) = 0 [pid 294] getdents64(3, [pid 1206] mkdir("./file1", 0777 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1206] <... mkdir resumed>) = 0 [pid 294] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1206] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./30/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./30/bus") = 0 [pid 294] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./30/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./30") = 0 [pid 294] mkdir("./31", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1210 ./strace-static-x86_64: Process 1210 attached [pid 1210] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1210] chdir("./31") = 0 [pid 1210] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1210] setpgid(0, 0) = 0 [pid 1210] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1210] write(3, "1000", 4) = 4 [pid 1195] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1195] ioctl(4, LOOP_CLR_FD) = 0 [pid 1195] close(4 [pid 297] <... umount2 resumed>) = 0 [pid 1195] <... close resumed>) = 0 [pid 1181] +++ exited with 0 +++ [pid 1195] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1191] exit_group(0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1181, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 1195] <... futex resumed>) = ? [pid 1191] <... exit_group resumed>) = ? [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 1195] +++ exited with 0 +++ [pid 296] <... restart_syscall resumed>) = 0 [pid 296] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1197] <... futex resumed>) = ? [pid 297] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./29/file1", [pid 296] newfstatat(AT_FDCWD, "./30/bus", [pid 1210] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 31.701440][ T1195] EXT4-fs warning (device loop5): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 31.722091][ T1206] loop1: detected capacity change from 0 to 512 [ 31.724342][ T1195] EXT4-fs (loop5): mount failed [ 31.734041][ T1204] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1210] <... close resumed>) = 0 [pid 296] unlink("./30/bus" [pid 1210] symlink("/dev/binderfs", "./binderfs" [pid 296] <... unlink resumed>) = 0 [pid 1210] <... symlink resumed>) = 0 [pid 296] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1210] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1210] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./30/binderfs", [pid 1210] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1210] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] unlink("./30/binderfs" [pid 1210] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] <... unlink resumed>) = 0 [pid 1210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 1210] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1210] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] close(3 [pid 1210] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 296] <... close resumed>) = 0 [pid 1210] <... mprotect resumed>) = 0 [pid 296] rmdir("./30" [pid 1210] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... rmdir resumed>) = 0 [pid 1210] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] mkdir("./31", 0777 [pid 1210] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... mkdir resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] close(4) = 0 [pid 297] rmdir("./29/file1" [pid 1210] <... clone3 resumed> => {parent_tid=[1213]}, 88) = 1213 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./29") = 0 [pid 297] mkdir("./30", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1214 ./strace-static-x86_64: Process 1213 attached [pid 1213] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1213] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1213] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1204] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1204] ioctl(4, LOOP_CLR_FD) = 0 [pid 1204] close(4) = 0 [pid 1204] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1204] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1210] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1210] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1210] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1210] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1210] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1210] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1215]}, 88) = 1215 [pid 1210] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1210] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1213] <... futex resumed>) = 0 [pid 1213] memfd_create("syzkaller", 0) = 3 [pid 1213] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1193] exit_group(0) = ? [pid 296] ioctl(3, LOOP_CLR_FD [pid 1205] <... futex resumed>) = ? [pid 1204] <... futex resumed>) = ? [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1205] +++ exited with 0 +++ [pid 296] close(3) = 0 [pid 1213] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1213] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1213] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 1213] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1215 attached ./strace-static-x86_64: Process 1214 attached [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1215] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1214] set_robust_list(0x555556d8d6a0, 24 [pid 1206] <... mount resumed>) = 0 [pid 1206] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1215] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 1216 attached [pid 1214] <... set_robust_list resumed>) = 0 [pid 1213] <... ioctl resumed>) = 0 [pid 1206] <... openat resumed>) = 5 [pid 1215] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1216 [pid 1216] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1216] chdir("./31") = 0 [pid 1216] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1216] setpgid(0, 0) = 0 [pid 1216] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1216] write(3, "1000", 4) = 4 [pid 1214] chdir("./30" [pid 1215] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1216] close(3 [pid 1215] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1206] chdir("./file1" [pid 1214] <... chdir resumed>) = 0 [pid 1216] <... close resumed>) = 0 [pid 1216] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1215] <... open resumed>) = 5 [pid 1214] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1206] <... chdir resumed>) = 0 [pid 1215] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1216] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1206] ioctl(6, LOOP_CLR_FD [pid 1214] <... prctl resumed>) = 0 [pid 1215] <... futex resumed>) = 1 [pid 1210] <... futex resumed>) = 0 [pid 1206] <... ioctl resumed>) = 0 [pid 1215] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1214] setpgid(0, 0 [pid 1210] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1216] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1216] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1210] <... futex resumed>) = 0 [pid 1206] close(6 [pid 1214] <... setpgid resumed>) = 0 [pid 1215] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1216] <... rt_sigprocmask resumed>[], 8) = 0 [ 31.757560][ T1204] EXT4-fs (loop4): get root inode failed [ 31.763195][ T1204] EXT4-fs (loop4): mount failed [ 31.770044][ T1206] EXT4-fs (loop1): 1 orphan inode deleted [ 31.776504][ T1206] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/29/file1 supports timestamps until 2038 (0x7fffffff) [ 31.781023][ T1213] loop0: detected capacity change from 0 to 512 [pid 1216] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1217]}, 88) = 1217 [pid 1216] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1216] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1216] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1216] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1216] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1197] +++ exited with 0 +++ [pid 1191] +++ exited with 0 +++ [pid 1216] <... clone3 resumed> => {parent_tid=[1218]}, 88) = 1218 [pid 1216] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1216] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1217 attached [pid 1217] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1217] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1217] memfd_create("syzkaller", 0) = 3 [pid 1217] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1217] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1217] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1217] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1217] <... openat resumed>) = 4 [pid 1217] ioctl(4, LOOP_SET_FD, 3 [pid 1215] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1214] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1206] <... close resumed>) = 0 [pid 1204] +++ exited with 0 +++ [pid 1193] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1191, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 1215] <... mount resumed>) = 0 [pid 1206] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1193, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1214] <... openat resumed>) = 3 [pid 1215] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1206] <... futex resumed>) = 0 [pid 1215] <... futex resumed>) = 1 [pid 1210] <... futex resumed>) = 0 [pid 1206] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1214] write(3, "1000", 4 [pid 1210] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1215] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1214] <... write resumed>) = 4 [pid 1210] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1215] <... open resumed>) = 6 [pid 1214] close(3 [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1215] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1214] <... close resumed>) = 0 [pid 1210] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1215] <... futex resumed>) = 0 [pid 1214] symlink("/dev/binderfs", "./binderfs" [pid 1210] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1215] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 298] <... openat resumed>) = 3 [pid 1217] <... ioctl resumed>) = 0 [pid 1217] close(3) = 0 [pid 1214] <... symlink resumed>) = 0 [pid 1210] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 1217] mkdir("./file1", 0777 [pid 1192] exit_group(0 [pid 1207] <... futex resumed>) = ? [pid 1192] <... exit_group resumed>) = ? [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1207] +++ exited with 0 +++ [pid 1206] <... futex resumed>) = ? [pid 1217] <... mkdir resumed>) = 0 [pid 1217] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1213] close(3) = 0 [pid 1213] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1213] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1206] +++ exited with 0 +++ [pid 1192] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1192, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1215] <... write resumed>) = 8 [pid 299] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 1215] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1214] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 3 [pid 295] newfstatat(3, "", [pid 1215] <... futex resumed>) = 1 [pid 1214] <... futex resumed>) = 0 [pid 1210] <... futex resumed>) = 0 [pid 1215] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1214] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 299] newfstatat(3, "", [pid 1210] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1215] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1214] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1210] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1215] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1214] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1210] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 295] getdents64(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1218 attached [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1218] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] newfstatat(AT_FDCWD, "./29/bus", [pid 295] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1218] <... set_robust_list resumed>) = 0 [pid 1218] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... umount2 resumed>) = 0 [pid 299] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1218] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1218] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 298] unlink("./29/bus" [pid 299] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./29/bus", [pid 298] <... unlink resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1214] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1215] <... write resumed>) = 1045 [pid 1214] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] newfstatat(AT_FDCWD, "./32/bus", [pid 298] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./29/bus" [pid 1218] <... open resumed>) = 3 [pid 1218] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] <... futex resumed>) = 0 [pid 1216] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1218] <... futex resumed>) = 1 [pid 1218] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1218] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] <... futex resumed>) = 0 [pid 1216] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1218] <... futex resumed>) = 1 [pid 1218] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1218] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] <... futex resumed>) = 0 [pid 1216] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1218] <... futex resumed>) = 1 [pid 1218] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 299] unlink("./32/bus" [pid 295] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1215] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1214] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1214] <... mprotect resumed>) = 0 [pid 1215] <... futex resumed>) = 1 [pid 295] newfstatat(AT_FDCWD, "./29/binderfs", [pid 1210] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./29/binderfs", [pid 1214] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1215] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] newfstatat(AT_FDCWD, "./32/binderfs", [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1214] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./29/binderfs" [pid 1214] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] unlink("./32/binderfs" [pid 298] unlink("./29/binderfs" [pid 295] <... unlink resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 295] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1214] <... clone3 resumed> => {parent_tid=[1219]}, 88) = 1219 [pid 299] getdents64(3, [pid 298] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1214] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 1214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 1214] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./29/file1", [pid 1214] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./32" [pid 1214] <... futex resumed>) = 0 [pid 298] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... rmdir resumed>) = 0 [pid 1214] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1214] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 1219 attached [pid 1214] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] mkdir("./33", 0777 [pid 1214] <... mprotect resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 1219] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1214] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(4, "", [pid 299] <... mkdir resumed>) = 0 [pid 1214] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1219] <... set_robust_list resumed>) = 0 [pid 298] getdents64(4, [pid 1214] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, [pid 299] <... openat resumed>) = 3 [pid 1214] <... clone3 resumed> => {parent_tid=[1220]}, 88) = 1220 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1214] rt_sigprocmask(SIG_SETMASK, [], [pid 1213] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] close(4 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1213] ioctl(4, LOOP_CLR_FD) = 0 [pid 1213] close(4) = 0 [pid 1213] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1213] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1220 attached [pid 1220] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 298] <... close resumed>) = 0 [pid 1220] rt_sigprocmask(SIG_SETMASK, [], [pid 1210] exit_group(0 [pid 1214] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1215] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 1210] <... exit_group resumed>) = ? [pid 1214] <... futex resumed>) = 0 [pid 298] rmdir("./29/file1" [pid 1215] +++ exited with 0 +++ [pid 1220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1220] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 298] <... rmdir resumed>) = 0 [pid 299] close(3 [pid 298] getdents64(3, [pid 1220] <... open resumed>) = 3 [pid 1220] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1214] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1214] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 1214] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] rmdir("./29" [pid 299] <... close resumed>) = 0 [pid 1220] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1220] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1220] <... futex resumed>) = 1 [pid 1214] <... futex resumed>) = 0 [pid 1220] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1214] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] mkdir("./30", 0777 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1221 [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR./strace-static-x86_64: Process 1221 attached [pid 1220] <... futex resumed>) = 0 [pid 1219] rt_sigprocmask(SIG_SETMASK, [], [pid 1213] <... futex resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 1218] <... write resumed>) = 8 [pid 1218] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] <... futex resumed>) = 0 [pid 1216] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1216] <... futex resumed>) = 0 [pid 1216] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1218] <... futex resumed>) = 1 [pid 1218] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1222 [pid 1218] <... write resumed>) = 1045 [pid 1218] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] <... futex resumed>) = 0 [pid 1218] <... futex resumed>) = 1 [pid 1218] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1222 attached [pid 1222] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1222] chdir("./30") = 0 [pid 1222] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1219] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1220] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1221] set_robust_list(0x555556d8d6a0, 24 [pid 1222] setpgid(0, 0) = 0 [pid 1222] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1220] <... open resumed>) = 4 [pid 1222] write(3, "1000", 4) = 4 [pid 1222] close(3) = 0 [pid 1219] memfd_create("syzkaller", 0 [pid 1222] symlink("/dev/binderfs", "./binderfs" [pid 1220] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1219] <... memfd_create resumed>) = 5 [pid 1222] <... symlink resumed>) = 0 [pid 1214] <... futex resumed>) = 0 [pid 1219] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1220] <... futex resumed>) = 1 [pid 1214] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1220] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1219] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1222] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1220] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1222] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1220] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1214] <... futex resumed>) = 0 [pid 1220] <... futex resumed>) = 1 [pid 1214] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1220] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1214] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1220] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1222] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1220] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1222] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1222] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1222] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1214] <... futex resumed>) = 0 [pid 1220] <... futex resumed>) = 1 [pid 1220] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1222] <... clone3 resumed> => {parent_tid=[1224]}, 88) = 1224 [pid 1222] rt_sigprocmask(SIG_SETMASK, [], [pid 1221] <... set_robust_list resumed>) = 0 [pid 1222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1222] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1222] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1222] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1221] chdir("./33" [pid 1222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1221] <... chdir resumed>) = 0 [pid 1221] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1221] setpgid(0, 0 [pid 1222] <... clone3 resumed> => {parent_tid=[1225]}, 88) = 1225 [pid 1221] <... setpgid resumed>) = 0 [pid 1222] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1221] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1222] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1221] <... openat resumed>) = 3 [pid 1221] write(3, "1000", 4) = 4 [pid 1221] close(3) = 0 [pid 1221] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 1225 attached [pid 1225] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1221] <... symlink resumed>) = 0 [pid 1225] <... set_robust_list resumed>) = 0 [pid 1225] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1225] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1221] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1219] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1221] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1221] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1221] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1225] <... open resumed>) = 3 [pid 1225] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1222] <... futex resumed>) = 0 [pid 1222] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1225] <... futex resumed>) = 1 [pid 1225] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1225] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1221] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1222] <... futex resumed>) = 0 [pid 1221] <... mprotect resumed>) = 0 [pid 1222] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1221] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1221] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1225] <... futex resumed>) = 1 [pid 1225] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1225] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1222] <... futex resumed>) = 0 [pid 1222] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1221] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1222] <... futex resumed>) = 0 [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1225] <... futex resumed>) = 1 [pid 1225] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1225] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1221] <... clone3 resumed> => {parent_tid=[1227]}, 88) = 1227 [pid 1221] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1221] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1222] <... futex resumed>) = 0 [pid 1222] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1222] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1225] <... futex resumed>) = 1 [pid 1225] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 1221] <... futex resumed>) = 0 [pid 1225] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1222] <... futex resumed>) = 0 [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1224 attached [pid 1225] <... futex resumed>) = 1 [pid 1221] <... futex resumed>) = 0 [pid 1225] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1224] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1221] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1224] <... set_robust_list resumed>) = 0 [pid 1221] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1221] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1224] rt_sigprocmask(SIG_SETMASK, [], [pid 1221] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1224] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1221] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1219] <... write resumed>) = 262144 [pid 1224] memfd_create("syzkaller", 0) = 5 [pid 1224] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [ 31.804008][ T1217] loop2: detected capacity change from 0 to 512 [ 31.816634][ T1213] EXT4-fs (loop0): Invalid log block size: 2475723007 [pid 1221] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0}./strace-static-x86_64: Process 1227 attached [pid 1219] munmap(0x7f0c41dcd000, 138412032 [pid 1227] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1221] <... clone3 resumed> => {parent_tid=[1228]}, 88) = 1228 [pid 1219] <... munmap resumed>) = 0 [pid 1227] <... set_robust_list resumed>) = 0 [pid 1221] rt_sigprocmask(SIG_SETMASK, [], [pid 1219] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1227] rt_sigprocmask(SIG_SETMASK, [], [pid 1221] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1219] <... openat resumed>) = 6 [pid 1227] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1221] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1219] ioctl(6, LOOP_SET_FD, 5 [pid 1227] memfd_create("syzkaller", 0 [pid 1221] <... futex resumed>) = 0 [pid 1227] <... memfd_create resumed>) = 3 [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1227] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1224] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1227] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1227] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1224] <... write resumed>) = 262144 [pid 1224] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1224] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1227] munmap(0x7f0c41dcd000, 138412032./strace-static-x86_64: Process 1228 attached [pid 1224] <... openat resumed>) = 6 [pid 1219] <... ioctl resumed>) = 0 [pid 1213] +++ exited with 0 +++ [pid 1210] +++ exited with 0 +++ [pid 1227] <... munmap resumed>) = 0 [pid 1219] close(5 [pid 1228] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1227] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1219] <... close resumed>) = 0 [pid 1228] <... set_robust_list resumed>) = 0 [pid 1227] <... openat resumed>) = 4 [pid 1219] mkdir("./file1", 0777 [pid 1228] rt_sigprocmask(SIG_SETMASK, [], [pid 1227] ioctl(4, LOOP_SET_FD, 3 [pid 1219] <... mkdir resumed>) = 0 [pid 1228] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1224] ioctl(6, LOOP_SET_FD, 5 [pid 1219] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... umount2 resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1210, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1228] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1217] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 295] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1228] <... open resumed>) = 5 [pid 1224] <... ioctl resumed>) = 0 [pid 1217] ioctl(4, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... restart_syscall resumed>) = 0 [pid 1228] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1224] close(5 [pid 295] newfstatat(AT_FDCWD, "./29/file1", [pid 1228] <... futex resumed>) = 1 [pid 1224] <... close resumed>) = 0 [pid 1221] <... futex resumed>) = 0 [pid 1217] <... ioctl resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1228] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1227] <... ioctl resumed>) = 0 [pid 1224] mkdir("./file1", 0777 [pid 1221] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1217] close(4 [pid 295] umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1227] close(3 [pid 1224] <... mkdir resumed>) = 0 [pid 1221] <... futex resumed>) = 0 [pid 1217] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1228] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1224] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1217] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1216] exit_group(0 [pid 295] openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1228] <... mount resumed>) = 0 [pid 1227] <... close resumed>) = 0 [pid 1218] <... futex resumed>) = ? [pid 1217] <... futex resumed>) = ? [pid 1216] <... exit_group resumed>) = ? [pid 295] <... openat resumed>) = 4 [pid 294] <... openat resumed>) = 3 [pid 1228] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1218] +++ exited with 0 +++ [pid 295] newfstatat(4, "", [pid 294] newfstatat(3, "", [pid 1228] <... futex resumed>) = 1 [pid 1227] mkdir("./bus", 0777 [pid 1221] <... futex resumed>) = 0 [pid 1217] +++ exited with 0 +++ [pid 1216] +++ exited with 0 +++ [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1228] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1227] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1221] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] getdents64(4, [pid 294] getdents64(3, [pid 1228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1227] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1221] <... futex resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1216, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1228] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 294] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1228] <... open resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1228] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] close(4 [pid 294] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1228] <... futex resumed>) = 1 [pid 1221] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1228] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1221] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(3, "", [pid 295] rmdir("./29/file1" [pid 294] newfstatat(AT_FDCWD, "./31/bus", [pid 1228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1221] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1228] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 294] unlink("./31/bus" [pid 1228] <... write resumed>) = 8 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [ 31.852650][ T1217] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.855997][ T1219] loop3: detected capacity change from 0 to 512 [ 31.873756][ T1217] EXT4-fs (loop2): get root inode failed [ 31.875021][ T1227] loop5: detected capacity change from 0 to 512 [ 31.880636][ T1217] EXT4-fs (loop2): mount failed [ 31.893686][ T1224] loop4: detected capacity change from 0 to 512 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1228] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 294] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1228] <... futex resumed>) = 1 [pid 1221] <... futex resumed>) = 0 [pid 1228] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1221] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1221] <... futex resumed>) = 0 [pid 1228] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1221] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1228] <... write resumed>) = 1045 [pid 296] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./29" [pid 294] newfstatat(AT_FDCWD, "./31/binderfs", [pid 1228] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1228] <... futex resumed>) = 1 [pid 1221] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./31/bus", [pid 295] <... rmdir resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1228] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./31/binderfs" [pid 296] unlink("./31/bus" [pid 295] mkdir("./30", 0777 [pid 296] <... unlink resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 296] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1219] <... mount resumed>) = 0 [pid 1219] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 1219] chdir("./file1") = 0 [pid 1219] ioctl(6, LOOP_CLR_FD) = 0 [pid 1219] close(6 [pid 296] newfstatat(AT_FDCWD, "./31/binderfs", [pid 294] close(3 [pid 1219] <... close resumed>) = 0 [pid 1219] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 31.932884][ T1219] EXT4-fs (loop3): 1 orphan inode deleted [ 31.946693][ T1219] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/30/file1 supports timestamps until 2038 (0x7fffffff) [ 31.953432][ T1227] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 31.972668][ T1224] EXT4-fs (loop4): 1 orphan inode deleted [pid 1219] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./31/binderfs" [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] <... close resumed>) = 0 [pid 1214] exit_group(0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] rmdir("./31" [pid 1220] <... futex resumed>) = ? [pid 1214] <... exit_group resumed>) = ? [pid 296] umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 294] <... rmdir resumed>) = 0 [pid 1220] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... close resumed>) = 0 [pid 294] mkdir("./32", 0777 [pid 296] newfstatat(AT_FDCWD, "./31/file1", [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... mkdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1235 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./31/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] newfstatat(4, "", [pid 294] <... openat resumed>) = 3 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 296] getdents64(4, [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] close(3 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 296] close(4 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./31/file1") = 0 [pid 296] getdents64(3, [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1236 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./31") = 0 [pid 296] mkdir("./32", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1237 [pid 1219] <... futex resumed>) = ? ./strace-static-x86_64: Process 1237 attached ./strace-static-x86_64: Process 1236 attached ./strace-static-x86_64: Process 1235 attached [pid 1219] +++ exited with 0 +++ [pid 1214] +++ exited with 0 +++ [pid 1237] set_robust_list(0x555556d8d6a0, 24 [pid 1236] set_robust_list(0x555556d8d6a0, 24 [pid 1235] set_robust_list(0x555556d8d6a0, 24 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1214, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./30/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./30/bus") = 0 [pid 297] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./30/binderfs") = 0 [pid 297] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1237] <... set_robust_list resumed>) = 0 [pid 1236] <... set_robust_list resumed>) = 0 [pid 1235] <... set_robust_list resumed>) = 0 [pid 1236] chdir("./32" [pid 1237] chdir("./32" [pid 1236] <... chdir resumed>) = 0 [pid 1235] chdir("./30" [pid 1224] <... mount resumed>) = 0 [pid 1224] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1235] <... chdir resumed>) = 0 [pid 1237] <... chdir resumed>) = 0 [pid 1236] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1235] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1237] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1236] <... prctl resumed>) = 0 [pid 1235] <... prctl resumed>) = 0 [pid 1237] <... prctl resumed>) = 0 [pid 1236] setpgid(0, 0 [pid 1235] setpgid(0, 0 [pid 1237] setpgid(0, 0 [pid 1236] <... setpgid resumed>) = 0 [pid 1235] <... setpgid resumed>) = 0 [pid 1237] <... setpgid resumed>) = 0 [pid 1236] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1235] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1237] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1235] <... openat resumed>) = 3 [pid 1237] <... openat resumed>) = 3 [pid 1237] write(3, "1000", 4 [pid 1236] <... openat resumed>) = 3 [pid 1235] write(3, "1000", 4 [pid 1224] <... openat resumed>) = 5 [pid 1236] write(3, "1000", 4 [pid 1237] <... write resumed>) = 4 [pid 1236] <... write resumed>) = 4 [pid 1235] <... write resumed>) = 4 [pid 1237] close(3 [pid 1236] close(3 [pid 1235] close(3 [pid 1237] <... close resumed>) = 0 [pid 1236] <... close resumed>) = 0 [pid 1235] <... close resumed>) = 0 [pid 1237] symlink("/dev/binderfs", "./binderfs" [pid 1236] symlink("/dev/binderfs", "./binderfs" [pid 1224] chdir("./file1" [pid 1237] <... symlink resumed>) = 0 [pid 1235] symlink("/dev/binderfs", "./binderfs" [pid 1236] <... symlink resumed>) = 0 [pid 1235] <... symlink resumed>) = 0 [pid 1224] <... chdir resumed>) = 0 [pid 1237] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1236] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] <... futex resumed>) = 0 [pid 1235] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 1224] ioctl(6, LOOP_CLR_FD) = 0 [pid 1224] close(6) = 0 [pid 1224] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1224] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1222] exit_group(0) = ? [pid 1225] <... futex resumed>) = -1 (errno 18446744073709551555) [pid 1225] +++ exited with 0 +++ [pid 1237] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1237] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1237] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1236] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1235] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1224] <... futex resumed>) = ? [pid 1227] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1227] ioctl(4, LOOP_CLR_FD [pid 1236] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1235] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1236] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1235] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1227] <... ioctl resumed>) = 0 [pid 1236] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1235] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1227] close(4 [pid 1236] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1235] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1227] <... close resumed>) = 0 [pid 1227] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1227] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1237] <... mprotect resumed>) = 0 [pid 1221] exit_group(0 [pid 1237] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1236] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1235] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1228] <... futex resumed>) = ? [pid 1227] <... futex resumed>) = ? [pid 1221] <... exit_group resumed>) = ? [pid 1228] +++ exited with 0 +++ [pid 1237] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1236] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1235] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1237] <... clone3 resumed> => {parent_tid=[1238]}, 88) = 1238 [pid 1236] <... mprotect resumed>) = 0 [pid 1235] <... mprotect resumed>) = 0 [pid 1237] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1237] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1236] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1235] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1236] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1235] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1236] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1235] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1237] <... futex resumed>) = 0 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1224] +++ exited with 0 +++ [pid 1222] +++ exited with 0 +++ [pid 1236] <... clone3 resumed> => {parent_tid=[1240]}, 88) = 1240 [pid 1235] <... clone3 resumed> => {parent_tid=[1239]}, 88) = 1239 ./strace-static-x86_64: Process 1239 attached ./strace-static-x86_64: Process 1240 attached ./strace-static-x86_64: Process 1238 attached [pid 1237] <... futex resumed>) = 0 [pid 1236] rt_sigprocmask(SIG_SETMASK, [], [pid 1235] rt_sigprocmask(SIG_SETMASK, [], [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1222, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1239] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1240] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1238] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1236] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1235] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 1239] <... set_robust_list resumed>) = 0 [pid 1240] <... set_robust_list resumed>) = 0 [pid 1238] <... set_robust_list resumed>) = 0 [pid 1237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1236] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... restart_syscall resumed>) = 0 [pid 1239] rt_sigprocmask(SIG_SETMASK, [], [pid 1240] rt_sigprocmask(SIG_SETMASK, [], [pid 1238] rt_sigprocmask(SIG_SETMASK, [], [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 1239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1240] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1239] memfd_create("syzkaller", 0 [pid 1240] memfd_create("syzkaller", 0 [pid 1238] memfd_create("syzkaller", 0 [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 298] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1239] <... memfd_create resumed>) = 3 [pid 1240] <... memfd_create resumed>) = 3 [pid 1238] <... memfd_create resumed>) = 3 [pid 1236] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1235] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1239] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1240] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1238] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1236] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1235] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1239] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1240] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1238] <... mmap resumed>) = 0x7f0c41dee000 [pid 1236] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1235] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] <... openat resumed>) = 3 [pid 1237] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1236] <... mprotect resumed>) = 0 [pid 1235] <... mprotect resumed>) = 0 [pid 298] newfstatat(3, "", [pid 1236] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1235] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1236] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1235] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1236] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1235] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] getdents64(3, [pid 1237] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1237] <... mprotect resumed>) = 0 [pid 1236] <... clone3 resumed> => {parent_tid=[1241]}, 88) = 1241 [pid 298] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1237] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1236] rt_sigprocmask(SIG_SETMASK, [], [pid 1235] <... clone3 resumed> => {parent_tid=[1242]}, 88) = 1242 [pid 1237] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1236] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1235] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = 0 [pid 1237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 1236] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1236] <... futex resumed>) = 0 [pid 1235] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1239] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1240] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1237] <... clone3 resumed> => {parent_tid=[1243]}, 88) = 1243 [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1235] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./30/bus", [pid 1237] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1237] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./30/bus" [pid 1237] <... futex resumed>) = 0 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./30/binderfs"./strace-static-x86_64: Process 1241 attached ) = 0 [pid 1241] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 298] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1241] <... set_robust_list resumed>) = 0 [pid 1241] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1241] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1241] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1236] <... futex resumed>) = 0 [pid 1241] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 31.978471][ T1227] EXT4-fs (loop5): get root inode failed [ 31.994494][ T1227] EXT4-fs (loop5): mount failed [ 32.007247][ T1224] ext4 filesystem being mounted at /root/syzkaller.qPQybd/30/file1 supports timestamps until 2038 (0x7fffffff) [pid 1236] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1241] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1239] <... write resumed>) = 262144 [pid 1240] <... write resumed>) = 262144 [pid 1236] <... futex resumed>) = 0 [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1239] munmap(0x7f0c41dcd000, 138412032 [pid 1240] munmap(0x7f0c41dcd000, 138412032 [pid 1241] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1239] <... munmap resumed>) = 0 [pid 1240] <... munmap resumed>) = 0 ./strace-static-x86_64: Process 1243 attached ./strace-static-x86_64: Process 1242 attached [pid 1241] <... mount resumed>) = 0 [pid 1239] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1238] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1243] set_robust_list(0x7f0c41ded9a0, 24 [pid 1242] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1241] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1240] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1239] <... openat resumed>) = 4 [pid 1240] <... openat resumed>) = 5 [pid 1239] ioctl(4, LOOP_SET_FD, 3 [pid 1240] ioctl(5, LOOP_SET_FD, 3 [pid 1243] <... set_robust_list resumed>) = 0 [pid 1243] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1238] <... write resumed>) = 262144 [pid 1243] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1243] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1237] <... futex resumed>) = 0 [pid 1243] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1237] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1243] <... mount resumed>) = 0 [pid 1237] <... futex resumed>) = 0 [pid 1243] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1243] <... futex resumed>) = 0 [pid 1237] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1243] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1237] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1243] <... open resumed>) = 5 [pid 1237] <... futex resumed>) = 0 [pid 1243] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1243] <... futex resumed>) = 0 [pid 1237] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1243] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1237] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1243] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1237] <... futex resumed>) = 0 [pid 1243] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1243] <... futex resumed>) = 0 [pid 1237] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1243] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1237] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1243] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1237] <... futex resumed>) = 0 [pid 1243] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1237] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1243] <... futex resumed>) = 0 [pid 1237] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1243] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1242] <... set_robust_list resumed>) = 0 [pid 1242] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1242] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 1242] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1242] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1241] <... futex resumed>) = 1 [pid 1241] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1239] <... ioctl resumed>) = 0 [pid 1239] close(3) = 0 [pid 1239] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1239] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1238] munmap(0x7f0c41dee000, 138412032) = 0 [pid 1238] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 1238] ioctl(6, LOOP_SET_FD, 3 [pid 1240] <... ioctl resumed>) = 0 [pid 1238] <... ioctl resumed>) = 0 [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 1227] +++ exited with 0 +++ [pid 1221] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 298] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1238] close(3 [pid 1236] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1242] <... futex resumed>) = 0 [pid 1241] <... futex resumed>) = 0 [pid 1238] <... close resumed>) = 0 [pid 1236] <... futex resumed>) = 1 [pid 1235] <... futex resumed>) = 1 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1221, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] newfstatat(AT_FDCWD, "./30/file1", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1240] close(3 [pid 1242] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1241] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1240] <... close resumed>) = 0 [pid 1238] mkdir("./bus", 0777 [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(AT_FDCWD, "./30/file1", [pid 1240] mkdir("./bus", 0777 [pid 1238] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1240] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1238] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1240] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(3, "", [pid 297] openat(AT_FDCWD, "./30/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... openat resumed>) = 4 [pid 299] getdents64(3, [pid 297] newfstatat(4, "", [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./30/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./30") = 0 [pid 297] mkdir("./31", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 1242] <... mount resumed>) = 0 [pid 1241] <... open resumed>) = 3 [pid 299] <... umount2 resumed>) = 0 [pid 298] umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 299] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1242] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1241] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./33/bus", [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1246 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./33/bus") = 0 [pid 299] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./33/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./33") = 0 [pid 299] mkdir("./34", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 1242] <... futex resumed>) = 1 [pid 1241] <... futex resumed>) = 1 [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./30/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1242] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1241] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1236] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 4 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1249 [pid 1242] <... open resumed>) = 3 ./strace-static-x86_64: Process 1246 attached [pid 1246] set_robust_list(0x555556d8d6a0, 24 [pid 1236] <... futex resumed>) = 0 [pid 1235] <... futex resumed>) = 0 [pid 298] newfstatat(4, "", [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1246] <... set_robust_list resumed>) = 0 [pid 1246] chdir("./31" [pid 1242] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1246] <... chdir resumed>) = 0 [pid 1242] <... futex resumed>) = 1 [pid 1241] <... write resumed>) = 8 [pid 1235] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 1246] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1242] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1241] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1242] <... write resumed>) = 8 [pid 1241] <... futex resumed>) = 1 [pid 1236] <... futex resumed>) = 0 [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(4, [pid 1246] <... prctl resumed>) = 0 [pid 1236] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1241] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1242] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1246] setpgid(0, 0) = 0 [pid 1246] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1236] <... futex resumed>) = 0 [pid 1246] write(3, "1000", 4) = 4 [pid 1236] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1246] close(3 [pid 1242] <... futex resumed>) = 1 [pid 1235] <... futex resumed>) = 0 [pid 1246] <... close resumed>) = 0 [pid 1242] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1241] <... write resumed>) = 1045 [pid 1235] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 1246] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 1249 attached ) = 0 [pid 1242] <... write resumed>) = 1045 [pid 1241] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1235] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [ 32.066970][ T1239] loop1: detected capacity change from 0 to 512 [ 32.073269][ T1240] loop0: detected capacity change from 0 to 512 [ 32.078363][ T1238] loop2: detected capacity change from 0 to 512 [ 32.098900][ T1239] EXT4-fs (loop1): 1 orphan inode deleted [ 32.105067][ T1239] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/30/bus supports timestamps until 2038 (0x7fffffff) [pid 1246] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1242] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1241] <... futex resumed>) = 1 [pid 1239] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1236] <... futex resumed>) = 0 [pid 1235] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] rmdir("./30/file1" [pid 1249] set_robust_list(0x555556d8d6a0, 24 [pid 1242] <... futex resumed>) = 0 [pid 1241] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1235] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... rmdir resumed>) = 0 [pid 1249] <... set_robust_list resumed>) = 0 [pid 1242] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] getdents64(3, [pid 1249] chdir("./34" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1249] <... chdir resumed>) = 0 [pid 298] close(3 [pid 1249] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... close resumed>) = 0 [pid 1249] <... prctl resumed>) = 0 [pid 298] rmdir("./30" [pid 1249] setpgid(0, 0 [pid 298] <... rmdir resumed>) = 0 [pid 1249] <... setpgid resumed>) = 0 [pid 298] mkdir("./31", 0777 [pid 1249] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... mkdir resumed>) = 0 [pid 1249] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1249] write(3, "1000", 4 [pid 298] <... openat resumed>) = 3 [pid 1249] <... write resumed>) = 4 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1249] close(3 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1249] <... close resumed>) = 0 [pid 298] close(3 [pid 1249] symlink("/dev/binderfs", "./binderfs" [pid 1239] ioctl(4, LOOP_CLR_FD [pid 298] <... close resumed>) = 0 [pid 1249] <... symlink resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1249] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1252 [pid 1249] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1249] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1249] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1239] <... ioctl resumed>) = 0 [pid 1249] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1249] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1239] close(4 [pid 1249] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1239] <... close resumed>) = 0 [pid 1249] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1249] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1253]}, 88) = 1253 [pid 1249] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1249] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1249] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1249] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1249] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1249] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1254]}, 88) = 1254 [pid 1249] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1249] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1252 attached [pid 1252] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1252] chdir("./31") = 0 [pid 1252] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1252] setpgid(0, 0) = 0 [pid 1252] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1252] write(3, "1000", 4) = 4 [pid 1252] close(3) = 0 [pid 1252] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1252] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1252] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1252] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1252] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1252] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1252] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1252] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1255]}, 88) = 1255 [pid 1252] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1252] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1252] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1252] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1252] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1252] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1256]}, 88) = 1256 [pid 1252] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1252] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1246] <... futex resumed>) = 0 [pid 1246] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1239] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1239] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1235] exit_group(0 [pid 1242] <... futex resumed>) = ? [pid 1235] <... exit_group resumed>) = ? [pid 1242] +++ exited with 0 +++ [pid 1246] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1246] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1246] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1239] <... futex resumed>) = ? [pid 1246] <... mprotect resumed>) = 0 [pid 1246] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1246] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1257]}, 88) = 1257 [pid 1246] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1246] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1246] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1246] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1246] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1246] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1258]}, 88) = 1258 [pid 1246] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 1253 attached ./strace-static-x86_64: Process 1255 attached ./strace-static-x86_64: Process 1256 attached ./strace-static-x86_64: Process 1254 attached [pid 1246] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1257 attached [pid 1257] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1257] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1257] memfd_create("syzkaller", 0) = 3 [pid 1257] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1254] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1253] set_robust_list(0x7f0c4a20e9a0, 24./strace-static-x86_64: Process 1258 attached [pid 1256] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1255] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1254] <... set_robust_list resumed>) = 0 [pid 1253] <... set_robust_list resumed>) = 0 [pid 1258] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1256] <... set_robust_list resumed>) = 0 [pid 1255] <... set_robust_list resumed>) = 0 [pid 1254] rt_sigprocmask(SIG_SETMASK, [], [pid 1253] rt_sigprocmask(SIG_SETMASK, [], [pid 1258] <... set_robust_list resumed>) = 0 [pid 1256] rt_sigprocmask(SIG_SETMASK, [], [pid 1255] rt_sigprocmask(SIG_SETMASK, [], [pid 1254] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1253] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1240] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1258] rt_sigprocmask(SIG_SETMASK, [], [pid 1256] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1255] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1254] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1253] memfd_create("syzkaller", 0 [pid 1256] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1255] memfd_create("syzkaller", 0 [pid 1253] <... memfd_create resumed>) = 3 [pid 1256] <... open resumed>) = 3 [pid 1255] <... memfd_create resumed>) = 4 [pid 1254] <... open resumed>) = 4 [pid 1258] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1256] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1255] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1254] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1240] ioctl(5, LOOP_CLR_FD [pid 1258] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1256] <... futex resumed>) = 1 [pid 1255] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1254] <... futex resumed>) = 1 [pid 1253] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1252] <... futex resumed>) = 0 [pid 1249] <... futex resumed>) = 0 [pid 1240] <... ioctl resumed>) = 0 [pid 1258] <... open resumed>) = 4 [pid 1252] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1249] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1257] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1255] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1252] <... futex resumed>) = 0 [pid 1249] <... futex resumed>) = 0 [pid 1253] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1254] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1258] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1256] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1257] <... write resumed>) = 262144 [pid 1258] <... futex resumed>) = 1 [pid 1255] <... write resumed>) = 262144 [pid 1254] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1246] <... futex resumed>) = 0 [pid 1258] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1256] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1257] munmap(0x7f0c41dcd000, 138412032 [pid 1246] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1258] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1256] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1255] munmap(0x7f0c41dcd000, 138412032 [pid 1254] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] <... write resumed>) = 262144 [pid 1246] <... futex resumed>) = 0 [pid 1240] close(5 [pid 1258] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1256] <... futex resumed>) = 1 [pid 1252] <... futex resumed>) = 0 [pid 1258] <... mount resumed>) = 0 [pid 1255] <... munmap resumed>) = 0 [pid 1254] <... futex resumed>) = 1 [pid 1256] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1252] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] munmap(0x7f0c41dcd000, 138412032 [pid 1249] <... futex resumed>) = 0 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1240] <... close resumed>) = 0 [pid 1257] <... munmap resumed>) = 0 [pid 1257] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [ 32.132338][ T1240] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.150180][ T1238] EXT4-fs (loop2): 1 orphan inode deleted [ 32.155808][ T1238] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/32/bus supports timestamps until 2038 (0x7fffffff) [ 32.171707][ T1240] EXT4-fs (loop0): get root inode failed [ 32.177381][ T1240] EXT4-fs (loop0): mount failed [pid 1257] ioctl(5, LOOP_SET_FD, 3 [pid 1258] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1256] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1255] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1254] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1253] <... munmap resumed>) = 0 [pid 1252] <... futex resumed>) = 0 [pid 1249] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1246] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1240] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1258] <... futex resumed>) = 0 [pid 1256] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1254] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1249] <... futex resumed>) = 0 [pid 1246] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1258] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1256] <... futex resumed>) = 0 [pid 1254] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1246] <... futex resumed>) = 0 [pid 1256] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1254] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1252] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1256] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1254] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1252] <... futex resumed>) = 0 [pid 1258] <... open resumed>) = 6 [pid 1257] <... ioctl resumed>) = 0 [pid 1256] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1255] <... openat resumed>) = 5 [pid 1254] <... futex resumed>) = 1 [pid 1253] <... openat resumed>) = 5 [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1249] <... futex resumed>) = 0 [pid 1240] <... futex resumed>) = 0 [pid 1256] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1255] ioctl(5, LOOP_SET_FD, 4 [pid 1254] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1253] ioctl(5, LOOP_SET_FD, 3 [pid 1249] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1236] exit_group(0 [pid 1258] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1257] close(3 [pid 1256] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1254] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1253] <... ioctl resumed>) = 0 [pid 1249] <... futex resumed>) = 0 [pid 1246] <... futex resumed>) = 0 [pid 1241] <... futex resumed>) = ? [pid 1236] <... exit_group resumed>) = ? [pid 1256] <... futex resumed>) = 1 [pid 1254] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1252] <... futex resumed>) = 0 [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1246] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1239] +++ exited with 0 +++ [pid 1235] +++ exited with 0 +++ [pid 1256] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1254] <... futex resumed>) = 0 [pid 1252] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1249] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1246] <... futex resumed>) = 0 [pid 1256] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1254] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1252] <... futex resumed>) = 0 [pid 1249] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1235, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1256] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1254] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1252] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1249] <... futex resumed>) = 0 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1258] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1256] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1254] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1249] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1241] +++ exited with 0 +++ [pid 295] <... restart_syscall resumed>) = 0 [pid 1258] <... write resumed>) = 8 [pid 1256] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1254] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1258] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1257] <... close resumed>) = 0 [pid 1256] <... futex resumed>) = 1 [pid 1255] <... ioctl resumed>) = 0 [pid 1254] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] close(3 [pid 1252] <... futex resumed>) = 0 [pid 1258] <... futex resumed>) = 1 [pid 1257] mkdir("./bus", 0777 [pid 1256] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1254] <... futex resumed>) = 1 [pid 1249] <... futex resumed>) = 0 [pid 1246] <... futex resumed>) = 0 [pid 295] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1258] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1257] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1254] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1246] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1255] close(4 [pid 1253] <... close resumed>) = 0 [pid 1258] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1246] <... futex resumed>) = 0 [pid 1257] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1258] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1246] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1238] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 295] <... openat resumed>) = 3 [pid 1238] ioctl(6, LOOP_CLR_FD [pid 295] newfstatat(3, "", [pid 1258] <... write resumed>) = 1045 [pid 1238] <... ioctl resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1253] mkdir("./file1", 0777 [pid 1238] close(6 [pid 295] getdents64(3, [pid 1253] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1238] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1253] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1238] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1258] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1238] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 1255] <... close resumed>) = 0 [pid 1238] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1237] exit_group(0 [pid 295] umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1258] <... futex resumed>) = 1 [pid 1255] mkdir("./file1", 0777 [pid 1246] <... futex resumed>) = 0 [pid 1238] <... futex resumed>) = ? [pid 1237] <... exit_group resumed>) = ? [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1258] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1255] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1243] <... futex resumed>) = ? [pid 1238] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./30/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./30/bus") = 0 [pid 295] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./30/binderfs") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./30" [pid 1257] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1255] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./31", 0777) = 0 [pid 1257] ioctl(5, LOOP_CLR_FD) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 1257] close(5 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 1259 attached [pid 1257] <... close resumed>) = 0 [pid 1259] set_robust_list(0x555556d8d6a0, 24 [pid 1257] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1246] exit_group(0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1259 [pid 1259] <... set_robust_list resumed>) = 0 [pid 1258] <... futex resumed>) = ? [pid 1257] <... futex resumed>) = ? [pid 1246] <... exit_group resumed>) = ? [pid 1258] +++ exited with 0 +++ [ 32.193675][ T1257] loop3: detected capacity change from 0 to 512 [ 32.202080][ T1253] loop5: detected capacity change from 0 to 512 [ 32.202524][ T1255] loop4: detected capacity change from 0 to 512 [ 32.225122][ T1257] EXT4-fs (loop3): Invalid log block size: 2475723007 [pid 1259] chdir("./31") = 0 [pid 1259] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1240] +++ exited with 0 +++ [pid 1236] +++ exited with 0 +++ [pid 1257] +++ exited with 0 +++ [pid 1246] +++ exited with 0 +++ [pid 1259] <... prctl resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1236, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1259] setpgid(0, 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1246, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1259] <... setpgid resumed>) = 0 [pid 1259] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1259] <... openat resumed>) = 3 [pid 1243] +++ exited with 0 +++ [pid 1237] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1259] write(3, "1000", 4 [pid 297] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1237, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1259] <... write resumed>) = 4 [pid 297] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 1259] close(3 [pid 297] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 1259] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1259] symlink("/dev/binderfs", "./binderfs" [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(3, [pid 1259] <... symlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1259] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 294] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1259] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 296] newfstatat(3, "", [pid 294] <... umount2 resumed>) = 0 [pid 1259] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 297] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1259] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1259] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] newfstatat(AT_FDCWD, "./31/bus", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] newfstatat(AT_FDCWD, "./32/bus", [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1255] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] unlink("./31/bus" [pid 296] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./32/bus" [pid 1259] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1255] ioctl(5, LOOP_CLR_FD [pid 297] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 1259] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1259] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1259] <... mprotect resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./31/binderfs", [pid 296] newfstatat(AT_FDCWD, "./32/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./32/binderfs" [pid 1259] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./32/bus" [pid 294] <... unlink resumed>) = 0 [pid 1259] <... rt_sigprocmask resumed>[], 8) = 0 [pid 294] getdents64(3, [pid 1259] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] unlink("./31/binderfs" [pid 296] <... unlink resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./32") = 0 [pid 294] mkdir("./33", 0777 [pid 297] <... unlink resumed>) = 0 [pid 296] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... mkdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1265 [pid 1259] <... clone3 resumed> => {parent_tid=[1264]}, 88) = 1264 [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1264 attached [pid 1264] set_robust_list(0x7f0c4a20e9a0, 24 [pid 296] newfstatat(AT_FDCWD, "./32/binderfs", [pid 1259] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1259] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... close resumed>) = 0 [pid 296] unlink("./32/binderfs" [pid 1259] <... futex resumed>) = 0 [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] rmdir("./31" [pid 296] <... unlink resumed>) = 0 [pid 1259] <... futex resumed>) = 0 [pid 1264] <... set_robust_list resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 1259] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] mkdir("./32", 0777 [pid 296] getdents64(3, [pid 1264] rt_sigprocmask(SIG_SETMASK, [], [pid 1259] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1264] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1264] memfd_create("syzkaller", 0 [pid 1259] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] <... mkdir resumed>) = 0 [pid 296] close(3 [pid 1259] <... mprotect resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... close resumed>) = 0 [pid 1259] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... openat resumed>) = 3 [pid 296] rmdir("./32" [pid 1259] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1264] <... memfd_create resumed>) = 3 [pid 1264] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1259] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] <... rmdir resumed>) = 0 [pid 1264] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1253] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] mkdir("./33", 0777 [pid 1259] <... clone3 resumed> => {parent_tid=[1266]}, 88) = 1266 [pid 1253] ioctl(5, LOOP_CLR_FD [pid 297] close(3 [pid 296] <... mkdir resumed>) = 0 [pid 1264] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1259] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... openat resumed>) = 3 [pid 1259] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1264] <... write resumed>) = 262144 [pid 1259] <... futex resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1267 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 ./strace-static-x86_64: Process 1266 attached [pid 1264] munmap(0x7f0c41dcd000, 138412032 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1266] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1264] <... munmap resumed>) = 0 [pid 1266] <... set_robust_list resumed>) = 0 [pid 1264] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1266] rt_sigprocmask(SIG_SETMASK, [], [pid 1264] <... openat resumed>) = 4 [pid 1266] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1264] ioctl(4, LOOP_SET_FD, 3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1268 [ 32.242071][ T1255] EXT4-fs (loop4): 1 orphan inode deleted [ 32.242875][ T1253] EXT4-fs (loop5): 1 orphan inode deleted [ 32.247905][ T1255] ext4 filesystem being mounted at /root/syzkaller.qPQybd/31/file1 supports timestamps until 2038 (0x7fffffff) [ 32.253589][ T1253] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/34/file1 supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 1268 attached ./strace-static-x86_64: Process 1267 attached ./strace-static-x86_64: Process 1265 attached [pid 1266] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1268] set_robust_list(0x555556d8d6a0, 24 [pid 1267] set_robust_list(0x555556d8d6a0, 24 [pid 1266] <... open resumed>) = 5 [pid 1265] set_robust_list(0x555556d8d6a0, 24 [pid 1264] <... ioctl resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1264] close(3 [pid 1266] <... futex resumed>) = 1 [pid 1264] <... close resumed>) = 0 [pid 1259] <... futex resumed>) = 0 [pid 1267] <... set_robust_list resumed>) = 0 [pid 1268] <... set_robust_list resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1265] <... set_robust_list resumed>) = 0 [pid 1264] mkdir("./bus", 0777 [pid 1259] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1268] chdir("./33" [pid 1267] chdir("./32" [pid 1266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] chdir("./33" [pid 1264] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1259] <... futex resumed>) = 0 [pid 1268] <... chdir resumed>) = 0 [pid 1267] <... chdir resumed>) = 0 [pid 1265] <... chdir resumed>) = 0 [pid 1264] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1268] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1267] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1266] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1265] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1267] <... prctl resumed>) = 0 [pid 1265] <... prctl resumed>) = 0 [pid 1267] setpgid(0, 0 [pid 1266] <... mount resumed>) = 0 [pid 1265] setpgid(0, 0 [pid 1267] <... setpgid resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] <... setpgid resumed>) = 0 [pid 1267] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1266] <... futex resumed>) = 1 [pid 1265] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1259] <... futex resumed>) = 0 [pid 1268] <... prctl resumed>) = 0 [pid 1267] <... openat resumed>) = 3 [pid 1266] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1265] <... openat resumed>) = 3 [pid 1259] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] write(3, "1000", 4 [pid 1266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] write(3, "1000", 4 [pid 1259] <... futex resumed>) = 0 [pid 1267] <... write resumed>) = 4 [pid 1266] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1265] <... write resumed>) = 4 [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1268] setpgid(0, 0 [pid 1267] close(3 [pid 1266] <... open resumed>) = 3 [pid 1265] close(3 [pid 1267] <... close resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] <... close resumed>) = 0 [pid 1268] <... setpgid resumed>) = 0 [pid 1267] symlink("/dev/binderfs", "./binderfs" [pid 1266] <... futex resumed>) = 1 [pid 1265] symlink("/dev/binderfs", "./binderfs" [pid 1259] <... futex resumed>) = 0 [pid 1267] <... symlink resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1265] <... symlink resumed>) = 0 [pid 1259] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1259] <... futex resumed>) = 0 [pid 1267] <... futex resumed>) = 0 [pid 1266] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1265] <... futex resumed>) = 0 [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1268] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1267] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1266] <... write resumed>) = 8 [pid 1265] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1268] <... openat resumed>) = 3 [pid 1267] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1266] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1268] write(3, "1000", 4 [pid 1267] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1266] <... futex resumed>) = 1 [pid 1265] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1259] <... futex resumed>) = 0 [pid 1268] <... write resumed>) = 4 [pid 1267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1266] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1259] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1268] close(3 [pid 1267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1259] <... futex resumed>) = 0 [pid 1268] <... close resumed>) = 0 [pid 1267] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1266] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1259] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1255] <... ioctl resumed>) = 0 [pid 1253] <... ioctl resumed>) = 0 [pid 1268] symlink("/dev/binderfs", "./binderfs" [pid 1267] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1266] <... write resumed>) = 1045 [pid 1268] <... symlink resumed>) = 0 [pid 1267] <... mprotect resumed>) = 0 [pid 1266] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1255] close(5 [pid 1253] close(5 [pid 1268] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1266] <... futex resumed>) = 1 [pid 1265] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1259] <... futex resumed>) = 0 [pid 1268] <... futex resumed>) = 0 [pid 1267] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1266] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1255] <... close resumed>) = 0 [pid 1253] <... close resumed>) = 0 [pid 1268] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [ 32.316350][ T1264] loop1: detected capacity change from 0 to 512 [pid 1267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1268] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1268] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1267] <... clone3 resumed> => {parent_tid=[1270]}, 88) = 1270 [pid 1268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1267] rt_sigprocmask(SIG_SETMASK, [], [pid 1268] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1265] <... mprotect resumed>) = 0 [pid 1255] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1253] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1268] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1267] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1252] exit_group(0 [pid 1268] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1267] <... futex resumed>) = 0 [pid 1265] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1256] <... futex resumed>) = ? [pid 1255] <... futex resumed>) = ? [pid 1253] <... futex resumed>) = 0 [pid 1252] <... exit_group resumed>) = ? [pid 1268] <... mprotect resumed>) = 0 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1256] +++ exited with 0 +++ [pid 1255] +++ exited with 0 +++ [pid 1268] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1267] <... futex resumed>) = 0 [pid 1253] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1252] +++ exited with 0 +++ [pid 1249] exit_group(0 [pid 1268] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1265] <... clone3 resumed> => {parent_tid=[1271]}, 88) = 1271 [pid 1254] <... futex resumed>) = ? [pid 1253] <... futex resumed>) = ? [pid 1249] <... exit_group resumed>) = ? [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1252, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 1268] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1267] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1265] rt_sigprocmask(SIG_SETMASK, [], [pid 1254] +++ exited with 0 +++ [pid 1253] +++ exited with 0 +++ [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 1267] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1249] +++ exited with 0 +++ [pid 298] <... restart_syscall resumed>) = 0 [pid 1268] <... clone3 resumed> => {parent_tid=[1272]}, 88) = 1272 [pid 1267] <... mprotect resumed>) = 0 [pid 1265] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1249, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1268] rt_sigprocmask(SIG_SETMASK, [], [pid 1267] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1265] <... futex resumed>) = 0 [pid 1268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1267] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1268] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1265] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1268] <... futex resumed>) = 0 [pid 1265] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 1273 attached ./strace-static-x86_64: Process 1272 attached ./strace-static-x86_64: Process 1271 attached ./strace-static-x86_64: Process 1270 attached [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] <... clone3 resumed> => {parent_tid=[1273]}, 88) = 1273 [pid 1265] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... openat resumed>) = 3 [pid 1273] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1272] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1271] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1270] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1265] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1273] <... set_robust_list resumed>) = 0 [pid 1272] <... set_robust_list resumed>) = 0 [pid 1271] <... set_robust_list resumed>) = 0 [pid 1270] <... set_robust_list resumed>) = 0 [pid 1265] <... mprotect resumed>) = 0 [pid 1273] rt_sigprocmask(SIG_SETMASK, [], [pid 1272] rt_sigprocmask(SIG_SETMASK, [], [pid 1271] rt_sigprocmask(SIG_SETMASK, [], [pid 1270] rt_sigprocmask(SIG_SETMASK, [], [pid 1265] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1273] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1272] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1271] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1265] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1273] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1272] memfd_create("syzkaller", 0 [pid 1271] memfd_create("syzkaller", 0 [pid 1270] memfd_create("syzkaller", 0 [pid 1265] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1272] <... memfd_create resumed>) = 3 [pid 1271] <... memfd_create resumed>) = 3 [pid 1270] <... memfd_create resumed>) = 3 [pid 1272] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1271] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1270] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1265] <... clone3 resumed> => {parent_tid=[1275]}, 88) = 1275 [pid 1272] <... mmap resumed>) = 0x7f0c41dee000 [pid 1271] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1270] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1265] rt_sigprocmask(SIG_SETMASK, [], [pid 1272] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1271] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1270] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1272] <... write resumed>) = 262144 [pid 1271] <... write resumed>) = 262144 [pid 1270] <... write resumed>) = 262144 [pid 1265] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1271] munmap(0x7f0c41dcd000, 138412032 [pid 1270] munmap(0x7f0c41dcd000, 138412032 [pid 1265] <... futex resumed>) = 0 [pid 1271] <... munmap resumed>) = 0 [pid 1270] <... munmap resumed>) = 0 [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1271] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1270] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1268] <... futex resumed>) = 0 [pid 1267] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 1275 attached [pid 1272] munmap(0x7f0c41dee000, 138412032 [pid 1271] <... openat resumed>) = 4 [pid 1270] <... openat resumed>) = 4 [pid 1268] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(3, "", [pid 1272] <... munmap resumed>) = 0 [pid 1271] ioctl(4, LOOP_SET_FD, 3 [pid 1275] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1272] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1270] ioctl(4, LOOP_SET_FD, 3 [pid 1268] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1267] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1275] <... set_robust_list resumed>) = 0 [pid 1271] <... ioctl resumed>) = 0 [pid 1268] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1267] <... futex resumed>) = 1 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 1275] rt_sigprocmask(SIG_SETMASK, [], [pid 1271] close(3 [pid 1268] <... mprotect resumed>) = 0 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 1275] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1271] <... close resumed>) = 0 [pid 1268] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... openat resumed>) = 3 [pid 298] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1275] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1271] mkdir("./bus", 0777 [pid 1268] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] newfstatat(3, "", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1275] <... open resumed>) = 3 [pid 1271] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1268] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] newfstatat(AT_FDCWD, "./31/binderfs", [pid 1275] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1271] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1275] <... futex resumed>) = 1 [pid 1268] <... clone3 resumed> => {parent_tid=[1276]}, 88) = 1276 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 298] unlink("./31/binderfs" [pid 1275] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1268] rt_sigprocmask(SIG_SETMASK, [], [pid 299] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... unlink resumed>) = 0 [pid 1268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1268] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(AT_FDCWD, "./34/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1268] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./31/file1", [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] unlink("./34/binderfs" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] unlink("./31/file1" [pid 299] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... unlink resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./34/file1", [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1273] <... futex resumed>) = 0 [pid 1265] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] close(3 [pid 1273] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1272] <... openat resumed>) = 4 [pid 1265] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1264] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] unlink("./34/file1" [pid 298] <... close resumed>) = 0 ./strace-static-x86_64: Process 1276 attached [pid 1264] ioctl(4, LOOP_CLR_FD [pid 299] <... unlink resumed>) = 0 [pid 298] rmdir("./31" [pid 1264] <... ioctl resumed>) = 0 [pid 299] getdents64(3, [pid 298] <... rmdir resumed>) = 0 [pid 1273] <... open resumed>) = 5 [pid 1272] ioctl(4, LOOP_SET_FD, 3 [pid 1264] close(4 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] mkdir("./32", 0777 [pid 1275] <... futex resumed>) = 0 [pid 1265] <... futex resumed>) = 1 [pid 1275] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1264] <... close resumed>) = 0 [pid 299] close(3 [pid 298] <... mkdir resumed>) = 0 [pid 1275] <... mount resumed>) = 0 [pid 1264] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1275] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1264] <... futex resumed>) = 0 [pid 299] rmdir("./34" [pid 298] <... openat resumed>) = 3 [pid 1275] <... futex resumed>) = 0 [pid 1264] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... rmdir resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1275] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] mkdir("./35", 0777 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1277 [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1279 ./strace-static-x86_64: Process 1277 attached [pid 1277] set_robust_list(0x555556d8d6a0, 24 [pid 1259] exit_group(0 [pid 1277] <... set_robust_list resumed>) = 0 [pid 1277] chdir("./32") = 0 [pid 1277] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1277] setpgid(0, 0) = 0 [pid 1277] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1277] write(3, "1000", 4) = 4 [pid 1277] close(3) = 0 [pid 1277] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1277] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1277] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1277] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1277] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1277] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1277] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1277] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1280]}, 88) = 1280 [pid 1277] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1277] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1277] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1277] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1277] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1277] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1273] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1266] <... futex resumed>) = ? [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1264] <... futex resumed>) = ? [pid 1259] <... exit_group resumed>) = ? [pid 1277] <... clone3 resumed> => {parent_tid=[1282]}, 88) = 1282 [pid 1266] +++ exited with 0 +++ [pid 1264] +++ exited with 0 +++ [pid 1277] rt_sigprocmask(SIG_SETMASK, [], [pid 1265] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1277] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1277] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1282 attached [pid 1282] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1259] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1259, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1273] <... futex resumed>) = 1 [pid 1267] <... futex resumed>) = 0 [pid 1265] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1276] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1273] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1267] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... restart_syscall resumed>) = 0 [pid 1267] <... futex resumed>) = 0 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] <... set_robust_list resumed>) = 0 [pid 1275] <... futex resumed>) = 0 [pid 1273] <... mount resumed>) = 0 [pid 1265] <... futex resumed>) = 1 [pid 295] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1275] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1272] <... ioctl resumed>) = 0 [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1275] <... open resumed>) = 5 [pid 1273] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1275] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1273] <... futex resumed>) = 1 [pid 1267] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 1275] <... futex resumed>) = 1 [pid 295] newfstatat(3, "", [pid 1275] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1273] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1267] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] <... futex resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1273] <... open resumed>) = 6 [pid 1267] <... futex resumed>) = 0 [pid 1265] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] getdents64(3, [pid 1275] <... futex resumed>) = 0 [pid 1273] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1265] <... futex resumed>) = 1 [pid 1276] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1275] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1273] <... futex resumed>) = 0 [pid 1267] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1280 attached [pid 1282] rt_sigprocmask(SIG_SETMASK, [], [pid 1276] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1275] <... write resumed>) = 8 [pid 1273] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1267] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = 0 [pid 1282] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1280] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1276] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1275] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1273] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1270] <... ioctl resumed>) = 0 [pid 1267] <... futex resumed>) = 0 [pid 295] umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1282] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1280] <... set_robust_list resumed>) = 0 [pid 1276] <... open resumed>) = 5 [pid 1275] <... futex resumed>) = 1 [pid 1273] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1270] close(3 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1265] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1282] <... open resumed>) = 3 [pid 1280] rt_sigprocmask(SIG_SETMASK, [], [pid 1276] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1275] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1270] <... close resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./31/bus", [pid 1282] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1280] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1275] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1270] mkdir("./bus", 0777 [pid 1265] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1282] <... futex resumed>) = 1 [pid 1280] memfd_create("syzkaller", 0 [pid 1277] <... futex resumed>) = 0 [pid 1276] <... futex resumed>) = 1 [pid 1275] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1273] <... write resumed>) = 8 [pid 1270] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1268] <... futex resumed>) = 0 [pid 1265] <... futex resumed>) = 0 [pid 295] unlink("./31/bus" [pid 1282] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1280] <... memfd_create resumed>) = 4 [pid 1277] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1276] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1275] <... write resumed>) = 1045 [pid 1273] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1270] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1268] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 1282] <... mount resumed>) = 0 [pid 1280] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1277] <... futex resumed>) = 0 [pid 1276] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1275] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1273] <... futex resumed>) = 1 [pid 1268] <... futex resumed>) = 0 [pid 1267] <... futex resumed>) = 0 [pid 1265] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1282] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1280] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1275] <... futex resumed>) = 0 [pid 1273] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1267] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1282] <... futex resumed>) = 0 [ 32.357348][ T1264] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.370831][ T1264] EXT4-fs (loop1): get root inode failed [ 32.371852][ T1271] loop0: detected capacity change from 0 to 512 [ 32.376489][ T1264] EXT4-fs (loop1): mount failed [ 32.384075][ T1270] loop3: detected capacity change from 0 to 512 [ 32.400283][ T1272] loop2: detected capacity change from 0 to 512 [pid 1280] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1276] <... mount resumed>) = 0 [pid 1275] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1273] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1267] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./31/binderfs", ./strace-static-x86_64: Process 1279 attached [pid 1282] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1276] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1273] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1272] close(3 [pid 1267] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] <... futex resumed>) = 1 [pid 1272] <... close resumed>) = 0 [pid 1268] <... futex resumed>) = 0 [pid 1276] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1272] mkdir("./bus", 0777 [pid 1268] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1276] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1272] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1268] <... futex resumed>) = 0 [pid 1276] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1272] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] <... open resumed>) = 3 [pid 1276] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1268] <... futex resumed>) = 0 [pid 1276] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1268] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1279] set_robust_list(0x555556d8d6a0, 24 [pid 1276] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1268] <... futex resumed>) = 0 [pid 1279] <... set_robust_list resumed>) = 0 [pid 1276] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1279] chdir("./35") = 0 [pid 1279] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1279] setpgid(0, 0) = 0 [pid 1279] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1279] write(3, "1000", 4) = 4 [pid 1279] close(3 [pid 1282] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1280] <... write resumed>) = 262144 [pid 1279] <... close resumed>) = 0 [pid 1277] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1276] <... write resumed>) = 8 [pid 1273] <... write resumed>) = 1045 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1282] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1277] <... futex resumed>) = 0 [pid 295] unlink("./31/binderfs" [pid 1282] <... open resumed>) = 5 [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 1282] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] getdents64(3, [pid 1282] <... futex resumed>) = 0 [pid 1277] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1282] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1277] <... futex resumed>) = 0 [pid 295] close(3 [pid 1282] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... close resumed>) = 0 [pid 1282] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1280] munmap(0x7f0c41dcd000, 138412032 [pid 1279] symlink("/dev/binderfs", "./binderfs" [pid 1276] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1273] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] rmdir("./31" [pid 1282] <... futex resumed>) = 0 [pid 1280] <... munmap resumed>) = 0 [pid 1279] <... symlink resumed>) = 0 [pid 1277] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1276] <... futex resumed>) = 1 [pid 1273] <... futex resumed>) = 1 [pid 1271] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1268] <... futex resumed>) = 0 [pid 1267] <... futex resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 1282] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1280] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1279] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1277] <... futex resumed>) = 0 [pid 1276] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1273] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1271] ioctl(4, LOOP_CLR_FD [pid 1268] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] mkdir("./32", 0777 [pid 1282] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1280] <... openat resumed>) = 6 [pid 1279] <... futex resumed>) = 0 [pid 1277] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1271] <... ioctl resumed>) = 0 [pid 1268] <... futex resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [ 32.422034][ T1271] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.435267][ T1270] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.449212][ T1271] EXT4-fs (loop0): get root inode failed [ 32.454677][ T1271] EXT4-fs (loop0): mount failed [ 32.461334][ T1270] EXT4-fs (loop3): get root inode failed [pid 1282] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1280] ioctl(6, LOOP_SET_FD, 4 [pid 1279] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1276] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1271] close(4 [pid 1268] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1282] <... futex resumed>) = 0 [pid 1279] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1276] <... write resumed>) = 1045 [pid 1271] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 1282] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1279] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1276] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1271] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1265] exit_group(0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 1279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1276] <... futex resumed>) = 1 [pid 1275] <... futex resumed>) = ? [pid 1271] <... futex resumed>) = ? [pid 1268] <... futex resumed>) = 0 [pid 1265] <... exit_group resumed>) = ? [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1279] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1276] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1275] +++ exited with 0 +++ [pid 1271] +++ exited with 0 +++ [pid 1265] +++ exited with 0 +++ [pid 295] close(3 [pid 1280] <... ioctl resumed>) = 0 [pid 1279] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] <... close resumed>) = 0 [pid 1280] close(4 [pid 1279] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1265, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1280] <... close resumed>) = 0 [pid 1279] <... mprotect resumed>) = 0 [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 1280] mkdir("./file1", 0777 [pid 1279] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1287 [pid 294] <... restart_syscall resumed>) = 0 [pid 1280] <... mkdir resumed>) = 0 [pid 1279] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1280] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1279] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 294] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1279] <... clone3 resumed> => {parent_tid=[1288]}, 88) = 1288 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1279] rt_sigprocmask(SIG_SETMASK, [], [pid 294] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] <... openat resumed>) = 3 [pid 1279] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] newfstatat(3, "", [pid 1279] <... futex resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 1279] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1279] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1287 attached [pid 1279] <... mmap resumed>) = 0x7f0c4a1cd000 ./strace-static-x86_64: Process 1288 attached [pid 1287] set_robust_list(0x555556d8d6a0, 24 [pid 1279] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1288] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1287] <... set_robust_list resumed>) = 0 [pid 1279] <... mprotect resumed>) = 0 [pid 1288] <... set_robust_list resumed>) = 0 [pid 1287] chdir("./32" [pid 1279] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1288] rt_sigprocmask(SIG_SETMASK, [], [pid 1287] <... chdir resumed>) = 0 [pid 1279] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1288] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1287] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1279] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1270] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1288] memfd_create("syzkaller", 0 [pid 1287] <... prctl resumed>) = 0 [pid 1270] ioctl(4, LOOP_CLR_FD [pid 1288] <... memfd_create resumed>) = 3 [pid 1287] setpgid(0, 0 [pid 1279] <... clone3 resumed> => {parent_tid=[1290]}, 88) = 1290 [pid 1270] <... ioctl resumed>) = 0 [pid 1288] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1287] <... setpgid resumed>) = 0 [pid 1279] rt_sigprocmask(SIG_SETMASK, [], [pid 1270] close(4./strace-static-x86_64: Process 1290 attached [ 32.465445][ T1280] loop4: detected capacity change from 0 to 512 [ 32.467228][ T1270] EXT4-fs (loop3): mount failed [ 32.477805][ T1272] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz-executor170: Invalid block bitmap block 2 in block_group 0 [ 32.492637][ T1272] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6146: Corrupt filesystem [ 32.504057][ T1272] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1288] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1287] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1270] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1288] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1287] <... openat resumed>) = 3 [pid 1279] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1270] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1267] exit_group(0 [pid 294] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1290] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1288] <... write resumed>) = 262144 [pid 1287] write(3, "1000", 4 [pid 1279] <... futex resumed>) = 0 [pid 1273] <... futex resumed>) = ? [pid 1270] <... futex resumed>) = ? [pid 1267] <... exit_group resumed>) = ? [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1290] <... set_robust_list resumed>) = 0 [pid 1290] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1290] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1290] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1290] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1273] +++ exited with 0 +++ [pid 1270] +++ exited with 0 +++ [pid 294] newfstatat(AT_FDCWD, "./33/bus", [pid 1288] munmap(0x7f0c41dcd000, 138412032 [pid 1287] <... write resumed>) = 4 [pid 1279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1279] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] unlink("./33/bus" [pid 1290] <... futex resumed>) = 0 [pid 1279] <... futex resumed>) = 1 [pid 294] <... unlink resumed>) = 0 [pid 1290] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1290] <... mount resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1290] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] newfstatat(AT_FDCWD, "./33/binderfs", [pid 1290] <... futex resumed>) = 1 [pid 1279] <... futex resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1290] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1279] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] unlink("./33/binderfs" [pid 1290] <... open resumed>) = 5 [pid 1279] <... futex resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1290] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] getdents64(3, [pid 1290] <... futex resumed>) = 0 [pid 1279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1290] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1279] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] close(3 [pid 1290] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1279] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 1290] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] rmdir("./33" [pid 1290] <... futex resumed>) = 0 [pid 1279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1290] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1279] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... rmdir resumed>) = 0 [pid 1290] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1279] <... futex resumed>) = 0 [pid 1290] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1279] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] mkdir("./34", 0777 [pid 1290] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1290] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... mkdir resumed>) = 0 [pid 1290] <... futex resumed>) = 1 [pid 1279] <... futex resumed>) = 0 [pid 1290] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1292 [ 32.517669][ T1272] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5820: Corrupt filesystem [ 32.527302][ T1272] EXT4-fs error (device loop2): __ext4_ext_dirty:183: inode #16: comm syz-executor170: mark_inode_dirty error [ 32.528981][ T1280] EXT4-fs (loop4): 1 orphan inode deleted [ 32.540902][ T1272] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.558072][ T1280] ext4 filesystem being mounted at /root/syzkaller.qPQybd/32/file1 supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 1292 attached [pid 1292] set_robust_list(0x555556d8d6a0, 24 [pid 1288] <... munmap resumed>) = 0 [pid 1287] close(3 [pid 1292] <... set_robust_list resumed>) = 0 [pid 1292] chdir("./34") = 0 [pid 1292] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1292] setpgid(0, 0) = 0 [pid 1292] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1292] write(3, "1000", 4) = 4 [pid 1292] close(3) = 0 [pid 1292] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1292] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1292] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1292] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1292] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1292] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1292] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1292] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1294]}, 88) = 1294 [pid 1292] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1292] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1292] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1292] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1292] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1288] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1287] <... close resumed>) = 0 [pid 1292] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1288] <... openat resumed>) = 6 [pid 1287] symlink("/dev/binderfs", "./binderfs" [pid 1292] <... clone3 resumed> => {parent_tid=[1295]}, 88) = 1295 [pid 1288] ioctl(6, LOOP_SET_FD, 3 [pid 1287] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 1295 attached ./strace-static-x86_64: Process 1294 attached [pid 1292] rt_sigprocmask(SIG_SETMASK, [], [pid 1280] <... mount resumed>) = 0 [pid 1295] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1294] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1295] <... set_robust_list resumed>) = 0 [pid 1294] <... set_robust_list resumed>) = 0 [pid 1280] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1295] rt_sigprocmask(SIG_SETMASK, [], [pid 1294] rt_sigprocmask(SIG_SETMASK, [], [pid 1295] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1294] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1280] <... openat resumed>) = 4 [pid 1295] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1294] memfd_create("syzkaller", 0) = 3 [pid 1280] chdir("./file1" [pid 1294] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1280] <... chdir resumed>) = 0 [pid 1294] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1280] ioctl(6, LOOP_CLR_FD [pid 1294] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1280] <... ioctl resumed>) = 0 [pid 1294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 1280] close(6 [pid 1294] ioctl(4, LOOP_SET_FD, 3 [pid 1292] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1288] <... ioctl resumed>) = 0 [pid 1287] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1292] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1288] close(3 [pid 1287] <... futex resumed>) = 0 [pid 1295] <... futex resumed>) = 0 [pid 1292] <... futex resumed>) = 1 [pid 1288] <... close resumed>) = 0 [pid 1287] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1295] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1288] mkdir("./bus", 0777 [pid 1287] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1295] <... open resumed>) = 5 [pid 1288] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1287] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1295] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1288] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1295] <... futex resumed>) = 1 [pid 1292] <... futex resumed>) = 0 [pid 1287] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1295] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1292] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1295] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1292] <... futex resumed>) = 0 [pid 1287] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1295] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1287] <... mprotect resumed>) = 0 [pid 1295] <... mount resumed>) = 0 [pid 1287] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1295] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1295] <... futex resumed>) = 1 [pid 1292] <... futex resumed>) = 0 [pid 1287] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1280] <... close resumed>) = 0 [pid 1295] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1292] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1280] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1277] exit_group(0 [pid 1295] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1292] <... futex resumed>) = 0 [pid 1287] <... clone3 resumed> => {parent_tid=[1297]}, 88) = 1297 [pid 1282] <... futex resumed>) = ? [pid 1280] <... futex resumed>) = ? [pid 1277] <... exit_group resumed>) = ? [pid 1295] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1287] rt_sigprocmask(SIG_SETMASK, [], [pid 1282] +++ exited with 0 +++ [pid 1280] +++ exited with 0 +++ [pid 1277] +++ exited with 0 +++ [pid 1287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1277, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1287] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1287] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1287] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1287] <... mmap resumed>) = 0x7f0c4a1cd000 [ 32.570350][ T1272] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5820: Corrupt filesystem [ 32.580453][ T1272] EXT4-fs error (device loop2): __ext4_ext_dirty:183: inode #16: comm syz-executor170: mark_inode_dirty error [ 32.582501][ T1288] loop5: detected capacity change from 0 to 512 [ 32.596397][ T1294] loop0: detected capacity change from 0 to 512 [ 32.604118][ T1272] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 298] <... openat resumed>) = 3 ./strace-static-x86_64: Process 1297 attached [pid 1295] <... open resumed>) = 6 [pid 1294] <... ioctl resumed>) = 0 [pid 1287] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1295] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... mprotect resumed>) = 0 [pid 298] getdents64(3, [pid 1295] <... futex resumed>) = 1 [pid 1292] <... futex resumed>) = 0 [pid 1295] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1287] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1295] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1292] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1297] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1295] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1292] <... futex resumed>) = 0 [pid 1287] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1267] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1297] <... set_robust_list resumed>) = 0 [pid 1297] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1297] memfd_create("syzkaller", 0) = 3 [pid 1297] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1267, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1297] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1297] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1295] <... write resumed>) = 8 [pid 1287] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1294] close(3 [pid 1297] <... write resumed>) = 262144 [pid 1294] <... close resumed>) = 0 [pid 1294] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1294] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1295] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 297] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1295] <... futex resumed>) = 1 [pid 1292] <... futex resumed>) = 0 [pid 1287] <... clone3 resumed> => {parent_tid=[1299]}, 88) = 1299 [pid 298] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1295] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1292] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1292] <... futex resumed>) = 0 [pid 1287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./32/bus", [pid 1292] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1287] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 1287] <... futex resumed>) = 0 [pid 297] newfstatat(3, "", [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] unlink("./32/bus" [pid 297] getdents64(3, [pid 1297] munmap(0x7f0c41dcd000, 138412032 [pid 298] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1295] <... write resumed>) = 1045 [pid 298] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1299 attached [pid 1297] <... munmap resumed>) = 0 [pid 1295] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1294] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1295] <... futex resumed>) = 1 [pid 1294] ioctl(4, LOOP_CLR_FD [pid 1292] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./32/binderfs", [pid 1297] <... openat resumed>) = 4 [pid 1295] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1294] <... ioctl resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1297] ioctl(4, LOOP_SET_FD, 3 [pid 1294] close(4 [pid 298] unlink("./32/binderfs" [pid 1299] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1294] <... close resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 1294] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1292] exit_group(0 [pid 298] umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1295] <... futex resumed>) = ? [ 32.618628][ T1272] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5820: Corrupt filesystem [ 32.633573][ T1294] EXT4-fs (loop0): Invalid log block size: 2475723007 [ 32.635113][ T1288] EXT4-fs (loop5): 1 orphan inode deleted [ 32.646456][ T1288] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/35/bus supports timestamps until 2038 (0x7fffffff) [ 32.658258][ T1297] loop1: detected capacity change from 0 to 512 [pid 1294] <... futex resumed>) = ? [pid 1292] <... exit_group resumed>) = ? [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1295] +++ exited with 0 +++ [pid 1294] +++ exited with 0 +++ [pid 1292] +++ exited with 0 +++ [pid 297] newfstatat(AT_FDCWD, "./32/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1292, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1299] <... set_robust_list resumed>) = 0 [pid 1297] <... ioctl resumed>) = 0 [pid 1288] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] unlink("./32/bus" [pid 1288] ioctl(6, LOOP_CLR_FD [pid 297] <... unlink resumed>) = 0 [pid 1288] <... ioctl resumed>) = 0 [pid 297] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1288] close(6 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1288] <... close resumed>) = 0 [pid 1287] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] newfstatat(AT_FDCWD, "./32/binderfs", [pid 1288] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 1279] exit_group(0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1290] <... futex resumed>) = ? [pid 1288] <... futex resumed>) = ? [pid 1287] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1279] <... exit_group resumed>) = ? [pid 297] unlink("./32/binderfs" [pid 294] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1290] +++ exited with 0 +++ [pid 1288] +++ exited with 0 +++ [pid 1287] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1287] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 294] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1287] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... openat resumed>) = 3 [pid 1287] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 297] close(3 [pid 294] newfstatat(3, "", [pid 1287] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 297] <... close resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1299] rt_sigprocmask(SIG_SETMASK, [], [pid 1297] close(3 [pid 1287] <... mprotect resumed>) = 0 [pid 297] rmdir("./32" [pid 294] getdents64(3, [pid 1299] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1297] <... close resumed>) = 0 [pid 1287] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1299] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1297] mkdir("./bus", 0777 [pid 1299] <... open resumed>) = 3 [pid 1297] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1287] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1287] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 297] mkdir("./33", 0777 [pid 294] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... mkdir resumed>) = 0 [pid 1287] <... clone3 resumed> => {parent_tid=[1300]}, 88) = 1300 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1287] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... openat resumed>) = 3 [pid 1287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 1287] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1287] <... futex resumed>) = 0 [pid 297] close(3 [pid 1287] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1301 ./strace-static-x86_64: Process 1300 attached [pid 1300] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 1299] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1297] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./34/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./34/bus") = 0 [pid 294] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./34/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./34") = 0 [pid 1300] <... set_robust_list resumed>) = 0 [pid 294] mkdir("./35", 0777 [pid 1300] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... mkdir resumed>) = 0 [pid 1300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR./strace-static-x86_64: Process 1301 attached [pid 1300] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1301] set_robust_list(0x555556d8d6a0, 24 [pid 1300] <... mount resumed>) = 0 [pid 1301] <... set_robust_list resumed>) = 0 [pid 1300] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1301] chdir("./33" [pid 1300] <... futex resumed>) = 1 [pid 1287] <... futex resumed>) = 0 [pid 1301] <... chdir resumed>) = 0 [pid 1300] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1287] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1301] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1287] <... futex resumed>) = 0 [pid 1301] <... prctl resumed>) = 0 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1301] setpgid(0, 0) = 0 [pid 1301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1301] write(3, "1000", 4) = 4 [pid 1301] close(3) = 0 [pid 1301] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1301] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1301] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1299] <... futex resumed>) = 1 [pid 1301] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1299] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1287] <... futex resumed>) = 0 [pid 1279] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 1301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 1301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1279, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1301] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] close(3 [pid 1301] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... close resumed>) = 0 [pid 1301] <... mprotect resumed>) = 0 [pid 299] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... openat resumed>) = 3 [pid 1301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] newfstatat(3, "", [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1302 [pid 1301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 1301] <... clone3 resumed> => {parent_tid=[1303]}, 88) = 1303 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1301] rt_sigprocmask(SIG_SETMASK, [], [pid 299] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1301] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(AT_FDCWD, "./35/bus", [pid 1301] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] unlink("./35/bus" [pid 1301] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... unlink resumed>) = 0 [pid 1301] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1301] <... mprotect resumed>) = 0 [pid 1299] <... open resumed>) = 5 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=32000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1299] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] newfstatat(AT_FDCWD, "./35/binderfs", [pid 1301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1299] <... futex resumed>) = 0 [pid 1287] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1299] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1287] <... futex resumed>) = 0 [pid 299] unlink("./35/binderfs" [pid 1299] <... write resumed>) = 8 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 1301] <... clone3 resumed> => {parent_tid=[1305]}, 88) = 1305 [pid 1299] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] getdents64(3, [pid 298] umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1302 attached [pid 1301] rt_sigprocmask(SIG_SETMASK, [], [pid 1299] <... futex resumed>) = 0 [pid 1287] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1302] set_robust_list(0x555556d8d6a0, 24 [pid 1301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1299] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1287] <... futex resumed>) = 0 [pid 299] close(3 [pid 298] newfstatat(AT_FDCWD, "./32/file1", [pid 1302] <... set_robust_list resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1299] <... write resumed>) = 1045 [pid 1287] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1302] chdir("./35" [pid 1301] <... futex resumed>) = 0 [pid 1299] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1287] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] rmdir("./35" [pid 298] umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1302] <... chdir resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1299] <... futex resumed>) = 0 [pid 1272] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... rmdir resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1305 attached [pid 1302] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1299] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] mkdir("./36", 0777 [pid 298] openat(AT_FDCWD, "./32/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1305] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1302] <... prctl resumed>) = 0 [pid 1272] ioctl(4, LOOP_CLR_FD [pid 299] <... mkdir resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 1305] <... set_robust_list resumed>) = 0 [ 32.658360][ T1272] EXT4-fs error (device loop2): ext4_truncate:4292: inode #16: comm syz-executor170: mark_inode_dirty error [ 32.676638][ T1272] EXT4-fs error (device loop2): ext4_evict_inode:294: comm syz-executor170: couldn't truncate inode 16 (err -117) [ 32.690592][ T1272] EXT4-fs (loop2): 1 orphan inode deleted [ 32.696449][ T1272] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/33/bus supports timestamps until 2038 (0x7fffffff) [pid 1302] setpgid(0, 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] newfstatat(4, "", ./strace-static-x86_64: Process 1303 attached [pid 1305] rt_sigprocmask(SIG_SETMASK, [], [pid 1302] <... setpgid resumed>) = 0 [pid 1272] <... ioctl resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1305] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] getdents64(4, [pid 1305] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1302] <... openat resumed>) = 3 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1305] <... open resumed>) = 3 [pid 1302] write(3, "1000", 4 [pid 299] close(3 [pid 298] getdents64(4, [pid 1305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] <... write resumed>) = 4 [pid 299] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1305] <... futex resumed>) = 1 [pid 1302] close(3 [pid 1301] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] close(4 [pid 1305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1302] <... close resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 1305] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1302] symlink("/dev/binderfs", "./binderfs" [pid 1301] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1307 [pid 298] rmdir("./32/file1" [pid 1305] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1302] <... symlink resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 1305] <... mount resumed>) = 0 [pid 1302] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 1305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1305] <... futex resumed>) = 1 [pid 1302] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1301] <... futex resumed>) = 0 [pid 298] close(3 [pid 1305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1302] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 1305] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1302] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1301] <... futex resumed>) = 0 [pid 298] rmdir("./32" [pid 1305] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1302] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 1305] <... open resumed>) = 4 [pid 1302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] mkdir("./33", 0777 [pid 1305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] <... mkdir resumed>) = 0 [pid 1305] <... futex resumed>) = 1 [pid 1302] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1301] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR./strace-static-x86_64: Process 1307 attached [pid 1305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1302] <... mprotect resumed>) = 0 [pid 1301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 1307] set_robust_list(0x555556d8d6a0, 24 [pid 1305] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1302] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1301] <... futex resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1307] <... set_robust_list resumed>) = 0 [pid 1305] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1302] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1307] chdir("./36" [pid 1305] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1302] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1272] close(4 [pid 298] close(3 [pid 1307] <... chdir resumed>) = 0 [pid 1305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1272] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 1307] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1305] <... futex resumed>) = 1 [pid 1302] <... clone3 resumed> => {parent_tid=[1308]}, 88) = 1308 [pid 1301] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1307] <... prctl resumed>) = 0 [pid 1305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1303] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1302] rt_sigprocmask(SIG_SETMASK, [], [pid 1301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1272] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1307] setpgid(0, 0 [pid 1305] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1303] <... set_robust_list resumed>) = 0 [pid 1302] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1301] <... futex resumed>) = 0 [pid 1272] <... futex resumed>) = 0 [pid 1268] exit_group(0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1309 [pid 1307] <... setpgid resumed>) = 0 [pid 1305] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1303] rt_sigprocmask(SIG_SETMASK, [], [pid 1302] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1276] <... futex resumed>) = ? [pid 1268] <... exit_group resumed>) = ? [pid 1307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1305] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1303] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1302] <... futex resumed>) = 0 [pid 1276] +++ exited with 0 +++ [pid 1272] +++ exited with 0 +++ [pid 1307] <... openat resumed>) = 3 [pid 1305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1303] memfd_create("syzkaller", 0 [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1307] write(3, "1000", 4 [pid 1305] <... futex resumed>) = 1 [pid 1303] <... memfd_create resumed>) = 5 [pid 1302] <... futex resumed>) = 0 [pid 1301] <... futex resumed>) = 0 [pid 1307] <... write resumed>) = 4 [pid 1305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1303] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1307] close(3 [pid 1303] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1302] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1307] <... close resumed>) = 0 [pid 1302] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1307] symlink("/dev/binderfs", "./binderfs" [pid 1302] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 1308 attached [pid 1307] <... symlink resumed>) = 0 [pid 1302] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 1309 attached [pid 1308] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1307] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1303] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1302] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1309] set_robust_list(0x555556d8d6a0, 24 [pid 1308] <... set_robust_list resumed>) = 0 [pid 1307] <... futex resumed>) = 0 [pid 1302] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1309] <... set_robust_list resumed>) = 0 [pid 1308] rt_sigprocmask(SIG_SETMASK, [], [pid 1307] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1309] chdir("./33" [pid 1308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1307] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1303] <... write resumed>) = 262144 [pid 1302] <... clone3 resumed> => {parent_tid=[1310]}, 88) = 1310 [pid 1309] <... chdir resumed>) = 0 [pid 1308] memfd_create("syzkaller", 0 [pid 1307] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1303] munmap(0x7f0c41dcd000, 138412032 [pid 1302] rt_sigprocmask(SIG_SETMASK, [], [pid 1309] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1308] <... memfd_create resumed>) = 3 [pid 1307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1303] <... munmap resumed>) = 0 [pid 1302] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1309] <... prctl resumed>) = 0 [pid 1308] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1303] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1302] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] setpgid(0, 0 [pid 1308] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1307] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1303] <... openat resumed>) = 6 [pid 1302] <... futex resumed>) = 0 [pid 1309] <... setpgid resumed>) = 0 [pid 1308] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1307] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1308] <... write resumed>) = 262144 [pid 1307] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 1310 attached [pid 1309] <... openat resumed>) = 3 [pid 1308] munmap(0x7f0c41dcd000, 138412032 [pid 1307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1310] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1309] write(3, "1000", 4 [pid 1308] <... munmap resumed>) = 0 [pid 1307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1310] <... set_robust_list resumed>) = 0 [pid 1309] <... write resumed>) = 4 [pid 1308] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1310] rt_sigprocmask(SIG_SETMASK, [], [pid 1309] close(3 [pid 1308] <... openat resumed>) = 4 [pid 1310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1309] <... close resumed>) = 0 [pid 1308] ioctl(4, LOOP_SET_FD, 3 [pid 1307] <... clone3 resumed> => {parent_tid=[1311]}, 88) = 1311 [pid 1303] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 1311 attached [pid 1310] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1309] symlink("/dev/binderfs", "./binderfs" [pid 1308] <... ioctl resumed>) = 0 [pid 1307] rt_sigprocmask(SIG_SETMASK, [], [pid 1310] <... open resumed>) = 5 [pid 1309] <... symlink resumed>) = 0 [pid 1308] close(3 [pid 1307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1308] <... close resumed>) = 0 [pid 1307] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1310] <... futex resumed>) = 1 [ 32.737899][ T1297] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.766828][ T1297] EXT4-fs (loop1): get root inode failed [ 32.772582][ T1297] EXT4-fs (loop1): mount failed [ 32.773417][ T1308] loop0: detected capacity change from 0 to 512 [pid 1309] <... futex resumed>) = 0 [pid 1308] mkdir("./bus", 0777 [pid 1307] <... futex resumed>) = 0 [pid 1302] <... futex resumed>) = 0 [pid 1310] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1309] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1308] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1309] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1308] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1307] <... futex resumed>) = 0 [pid 1302] <... futex resumed>) = 0 [pid 1311] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1310] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1303] <... ioctl resumed>) = 0 [pid 1297] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1311] <... set_robust_list resumed>) = 0 [pid 1303] close(5 [pid 1297] ioctl(4, LOOP_CLR_FD [pid 1311] rt_sigprocmask(SIG_SETMASK, [], [pid 1303] <... close resumed>) = 0 [pid 1297] <... ioctl resumed>) = 0 [pid 1311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1303] mkdir("./file1", 0777 [pid 1297] close(4 [pid 1311] memfd_create("syzkaller", 0 [pid 1310] <... mount resumed>) = 0 [pid 1309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1297] <... close resumed>) = 0 [pid 1268] +++ exited with 0 +++ [pid 1310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1307] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1310] <... futex resumed>) = 0 [pid 1309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1307] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1302] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1268, si_uid=0, si_status=0, si_utime=0, si_stime=15} --- [pid 1311] <... memfd_create resumed>) = 3 [pid 1310] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1309] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1307] <... mprotect resumed>) = 0 [pid 1302] <... futex resumed>) = 0 [pid 1297] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 1311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1310] <... open resumed>) = 3 [pid 1309] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1297] <... futex resumed>) = 0 [pid 1287] exit_group(0 [pid 296] <... restart_syscall resumed>) = 0 [pid 1311] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] <... mprotect resumed>) = 0 [pid 1307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1300] <... futex resumed>) = ? [pid 1299] <... futex resumed>) = ? [pid 1287] <... exit_group resumed>) = ? [pid 1310] <... futex resumed>) = 0 [pid 1309] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1302] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1300] +++ exited with 0 +++ [pid 1311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1310] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1309] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1302] <... futex resumed>) = 0 [pid 1299] +++ exited with 0 +++ [pid 296] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1307] <... clone3 resumed> => {parent_tid=[1312]}, 88) = 1312 [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1311] <... write resumed>) = 262144 [pid 1310] <... write resumed>) = 8 [pid 1307] rt_sigprocmask(SIG_SETMASK, [], [pid 296] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1311] munmap(0x7f0c41dcd000, 138412032 [pid 1310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] <... clone3 resumed> => {parent_tid=[1313]}, 88) = 1313 [pid 1307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... openat resumed>) = 3 [pid 1310] <... futex resumed>) = 1 [pid 1309] rt_sigprocmask(SIG_SETMASK, [], [pid 1307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 1310] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1307] <... futex resumed>) = 0 [pid 1302] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1311] <... munmap resumed>) = 0 [pid 1310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1309] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1302] <... futex resumed>) = 0 [pid 296] getdents64(3, ./strace-static-x86_64: Process 1313 attached ./strace-static-x86_64: Process 1312 attached [pid 1311] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1310] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1309] <... futex resumed>) = 0 [pid 1303] <... mkdir resumed>) = 0 [pid 1302] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1313] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1312] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1311] <... openat resumed>) = 4 [pid 1310] <... write resumed>) = 1045 [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1303] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [ 32.777792][ T1303] loop3: detected capacity change from 0 to 512 [pid 296] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1313] <... set_robust_list resumed>) = 0 [pid 1312] <... set_robust_list resumed>) = 0 [pid 1311] ioctl(4, LOOP_SET_FD, 3 [pid 1310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 1310] <... futex resumed>) = 1 [pid 1309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1302] <... futex resumed>) = 0 [pid 296] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1310] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1309] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1309] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] newfstatat(AT_FDCWD, "./33/bus", [pid 1309] <... mprotect resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1309] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] unlink("./33/bus" [pid 1309] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... unlink resumed>) = 0 [pid 1309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1309] <... clone3 resumed> => {parent_tid=[1314]}, 88) = 1314 [pid 296] newfstatat(AT_FDCWD, "./33/binderfs", [pid 1309] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./33/binderfs" [pid 1309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 1309] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./33") = 0 [pid 296] mkdir("./34", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1315 [pid 1311] <... ioctl resumed>) = 0 [pid 1313] rt_sigprocmask(SIG_SETMASK, [], [pid 1312] rt_sigprocmask(SIG_SETMASK, [], [pid 1313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1311] close(3 [pid 1313] memfd_create("syzkaller", 0 [pid 1312] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1311] <... close resumed>) = 0 ./strace-static-x86_64: Process 1314 attached [pid 1314] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1314] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1313] <... memfd_create resumed>) = 4 [pid 1312] <... open resumed>) = 3 [pid 1311] mkdir("./bus", 0777 [pid 1314] <... open resumed>) = 3 [pid 1314] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1309] <... futex resumed>) = 0 [pid 1314] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1314] <... mount resumed>) = 0 [pid 1309] <... futex resumed>) = 0 [pid 1297] +++ exited with 0 +++ [pid 1287] +++ exited with 0 +++ [pid 1314] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1287, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1314] <... futex resumed>) = 0 [pid 1309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1314] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1314] <... open resumed>) = 5 [pid 1309] <... futex resumed>) = 0 [pid 1314] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1314] <... futex resumed>) = 0 [pid 1309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1314] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... restart_syscall resumed>) = 0 [pid 1314] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1309] <... futex resumed>) = 0 [pid 1314] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1315 attached [pid 1314] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 295] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1315] set_robust_list(0x555556d8d6a0, 24 [pid 1314] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1315] <... set_robust_list resumed>) = 0 [pid 1314] <... futex resumed>) = 1 [pid 1309] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1315] chdir("./34" [pid 1314] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 1315] <... chdir resumed>) = 0 [pid 1314] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1309] <... futex resumed>) = 0 [pid 295] newfstatat(3, "", [pid 1315] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1314] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1315] <... prctl resumed>) = 0 [pid 1314] <... futex resumed>) = 0 [pid 1309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] getdents64(3, [pid 1315] setpgid(0, 0 [pid 1314] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1315] <... setpgid resumed>) = 0 [pid 295] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... umount2 resumed>) = 0 [pid 1315] <... openat resumed>) = 3 [pid 295] umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1315] write(3, "1000", 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1315] <... write resumed>) = 4 [pid 295] newfstatat(AT_FDCWD, "./32/bus", [pid 1315] close(3 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1315] <... close resumed>) = 0 [pid 295] unlink("./32/bus" [pid 1315] symlink("/dev/binderfs", "./binderfs" [pid 295] <... unlink resumed>) = 0 [pid 1315] <... symlink resumed>) = 0 [pid 295] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1315] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1315] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./32/binderfs", [pid 1315] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1315] <... rt_sigaction resumed>NULL, 8) = 0 [pid 295] unlink("./32/binderfs" [pid 1315] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 295] <... unlink resumed>) = 0 [pid 1315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] getdents64(3, [pid 1315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1315] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] close(3 [pid 1315] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] <... close resumed>) = 0 [pid 1315] <... mprotect resumed>) = 0 [pid 295] rmdir("./32" [pid 1315] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] <... rmdir resumed>) = 0 [pid 1315] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] mkdir("./33", 0777 [pid 1315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 295] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1315] <... clone3 resumed> => {parent_tid=[1319]}, 88) = 1319 [pid 295] <... openat resumed>) = 3 [pid 1315] rt_sigprocmask(SIG_SETMASK, [], [pid 295] ioctl(3, LOOP_CLR_FD [pid 1315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1315] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 1315] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1315] <... futex resumed>) = 0 [pid 1315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1320 [pid 1315] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1315] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1321]}, 88) = 1321 [pid 1315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1315] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1313] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1313] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1313] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1313] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 6 [pid 1313] ioctl(6, LOOP_SET_FD, 4./strace-static-x86_64: Process 1320 attached [pid 1312] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1311] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1307] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 32.810631][ T1311] loop5: detected capacity change from 0 to 512 [ 32.830506][ T1303] EXT4-fs (loop3): 1 orphan inode deleted [ 32.836077][ T1303] EXT4-fs mount: 32 callbacks suppressed [ 32.836093][ T1303] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 32.845464][ T1313] loop4: detected capacity change from 0 to 512 [pid 1307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = 0 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=49000000} [pid 1312] <... futex resumed>) = 1 [pid 1312] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1312] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1307] <... futex resumed>) = 0 [pid 1307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1312] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1312] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1307] <... futex resumed>) = 0 [pid 1307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1312] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 1312] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1311] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1312] <... futex resumed>) = 1 [pid 1307] <... futex resumed>) = 0 [pid 1307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1312] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = 1045 [pid 1312] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1307] <... futex resumed>) = 0 [pid 1312] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1320] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1320] chdir("./33") = 0 [pid 1320] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1303] <... mount resumed>) = 0 ./strace-static-x86_64: Process 1319 attached [pid 1320] setpgid(0, 0) = 0 [pid 1320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1320] write(3, "1000", 4) = 4 [pid 1320] close(3) = 0 [pid 1320] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 1321 attached [pid 1319] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1303] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1321] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1319] <... set_robust_list resumed>) = 0 [pid 1303] <... openat resumed>) = 5 [pid 1303] chdir("./file1" [pid 1321] <... set_robust_list resumed>) = 0 [pid 1319] rt_sigprocmask(SIG_SETMASK, [], [pid 1320] <... symlink resumed>) = 0 [pid 1320] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1303] <... chdir resumed>) = 0 [pid 1319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1321] rt_sigprocmask(SIG_SETMASK, [], [pid 1303] ioctl(6, LOOP_CLR_FD [pid 1320] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1303] <... ioctl resumed>) = 0 [pid 1320] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1320] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1303] close(6 [pid 1319] memfd_create("syzkaller", 0 [pid 1320] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1320] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1319] <... memfd_create resumed>) = 3 [pid 1313] <... ioctl resumed>) = 0 [pid 1303] <... close resumed>) = 0 [pid 1321] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1313] close(4 [pid 1303] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1301] exit_group(0 [pid 1321] <... open resumed>) = 4 [pid 1319] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1313] <... close resumed>) = 0 [pid 1305] <... futex resumed>) = ? [pid 1303] <... futex resumed>) = ? [pid 1301] <... exit_group resumed>) = ? [pid 1321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1313] mkdir("./bus", 0777 [pid 1305] +++ exited with 0 +++ [pid 1303] +++ exited with 0 +++ [pid 1301] +++ exited with 0 +++ [pid 1321] <... futex resumed>) = 1 [pid 1319] <... write resumed>) = 262144 [pid 1315] <... futex resumed>) = 0 [pid 1313] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1301, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 1321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1319] munmap(0x7f0c41dcd000, 138412032 [pid 1315] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1313] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1319] <... munmap resumed>) = 0 [pid 1315] <... futex resumed>) = 0 [pid 1321] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1319] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1321] <... mount resumed>) = 0 [pid 1319] <... openat resumed>) = 5 [pid 1321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1319] ioctl(5, LOOP_SET_FD, 3 [pid 1321] <... futex resumed>) = 1 [pid 1320] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1319] <... ioctl resumed>) = 0 [pid 1315] <... futex resumed>) = 0 [pid 1321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1320] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1319] close(3 [pid 1315] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1319] <... close resumed>) = 0 [pid 1315] <... futex resumed>) = 0 [pid 297] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1311] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1321] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1319] mkdir("./bus", 0777 [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1321] <... open resumed>) = 3 [pid 1320] <... clone3 resumed> => {parent_tid=[1324]}, 88) = 1324 [pid 1319] <... mkdir resumed>) = -1 EEXIST (File exists) [ 32.859085][ T1303] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/33/file1 supports timestamps until 2038 (0x7fffffff) [ 32.878110][ T1308] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 32.891072][ T1319] loop2: detected capacity change from 0 to 512 [ 32.897894][ T1311] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 32.901072][ T1308] EXT4-fs (loop0): get root inode failed [pid 1321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] rt_sigprocmask(SIG_SETMASK, [], [pid 1319] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1311] ioctl(4, LOOP_CLR_FD [pid 297] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 1324 attached [pid 1324] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1324] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1321] <... futex resumed>) = 1 [pid 1320] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1315] <... futex resumed>) = 0 [pid 1311] <... ioctl resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 1321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1320] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1315] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1311] close(4 [pid 297] newfstatat(3, "", [pid 1321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1320] <... futex resumed>) = 1 [pid 1315] <... futex resumed>) = 0 [pid 1311] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1321] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1311] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 1321] <... write resumed>) = 8 [pid 1320] <... futex resumed>) = 0 [pid 1311] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1311] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1307] exit_group(0 [pid 297] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1321] <... futex resumed>) = 1 [pid 1320] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1315] <... futex resumed>) = 0 [pid 1311] <... futex resumed>) = ? [pid 1307] <... exit_group resumed>) = ? [pid 1321] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1320] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1315] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1311] +++ exited with 0 +++ [pid 1321] <... write resumed>) = 1045 [pid 1320] <... mprotect resumed>) = 0 [pid 1315] <... futex resumed>) = 0 [pid 1321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1315] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1321] <... futex resumed>) = 0 [pid 1320] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1326]}, 88) = 1326 [pid 1320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1320] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./33/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./33/bus") = 0 [pid 297] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./33/binderfs") = 0 [pid 297] umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1326 attached [pid 1324] <... futex resumed>) = 0 [pid 1319] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1312] <... futex resumed>) = ? [pid 1308] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1324] memfd_create("syzkaller", 0 [pid 1312] +++ exited with 0 +++ [pid 1308] ioctl(4, LOOP_CLR_FD [pid 1307] +++ exited with 0 +++ [pid 1308] <... ioctl resumed>) = 0 [pid 1324] <... memfd_create resumed>) = 3 [pid 1308] close(4 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1307, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 299] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1324] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1308] <... close resumed>) = 0 [pid 299] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1324] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1308] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./36/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./36/bus") = 0 [pid 299] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1324] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 299] newfstatat(AT_FDCWD, "./36/binderfs", [pid 1308] <... futex resumed>) = 0 [pid 1308] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./36/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./36") = 0 [pid 299] mkdir("./37", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1326] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1326] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1326] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] <... futex resumed>) = 0 [pid 1320] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1326] <... futex resumed>) = 1 [pid 1326] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1302] exit_group(0 [pid 1326] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1302] <... exit_group resumed>) = ? [pid 1310] <... futex resumed>) = ? [pid 1308] <... futex resumed>) = ? [pid 1320] <... futex resumed>) = 0 [pid 1320] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1310] +++ exited with 0 +++ [pid 1326] <... futex resumed>) = 1 [pid 1308] +++ exited with 0 +++ [pid 1326] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1326] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] <... futex resumed>) = 0 [pid 1320] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1302] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1302, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1326] <... futex resumed>) = 1 [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./35/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./35/bus") = 0 [pid 294] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1326] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 294] unlink("./35/binderfs" [pid 1326] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 294] <... unlink resumed>) = 0 [pid 1326] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 1326] <... futex resumed>) = 1 [pid 1320] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1326] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1320] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] close(3 [pid 1326] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1320] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 1326] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1320] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] rmdir("./35" [pid 1326] <... futex resumed>) = 0 [pid 1320] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... rmdir resumed>) = 0 [pid 1326] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] mkdir("./36", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 1324] <... write resumed>) = 262144 [pid 294] ioctl(3, LOOP_CLR_FD) = 0 [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1324] munmap(0x7f0c41dcd000, 138412032 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1327 [pid 1319] ioctl(5, LOOP_CLR_FD) = 0 [pid 1319] close(5) = 0 [pid 1319] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1324] <... munmap resumed>) = 0 [pid 1319] <... futex resumed>) = 0 [pid 1319] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1324] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 6 [pid 1324] ioctl(6, LOOP_SET_FD, 3 [pid 1315] exit_group(0) = ? [pid 1319] <... futex resumed>) = 230 [pid 1321] <... futex resumed>) = ? [pid 1321] +++ exited with 0 +++ [ 32.911964][ T1308] EXT4-fs (loop0): mount failed [ 32.914291][ T1313] EXT4-fs (loop4): 1 orphan inode deleted [ 32.922834][ T1313] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 32.934222][ T1319] EXT4-fs (loop2): fragment/cluster size (0) != block size (4096) [ 32.939304][ T1313] ext4 filesystem being mounted at /root/syzkaller.qPQybd/33/bus supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 1327 attached [pid 1327] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1327] chdir("./36") = 0 [pid 1327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1327] setpgid(0, 0) = 0 [pid 1327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1327] write(3, "1000", 4) = 4 [pid 1327] close(3) = 0 [pid 1327] symlink("/dev/binderfs", "./binderfs" [pid 1324] <... ioctl resumed>) = 0 [pid 1327] <... symlink resumed>) = 0 [pid 1324] close(3 [pid 1327] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1327] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1324] <... close resumed>) = 0 [pid 1319] +++ exited with 0 +++ [pid 1315] +++ exited with 0 +++ [pid 1313] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1315, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] close(3 [pid 297] newfstatat(AT_FDCWD, "./33/file1", [pid 1313] ioctl(6, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./34/bus", [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1313] <... ioctl resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./34/bus") = 0 [pid 1313] close(6 [pid 297] umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1328 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./34/binderfs", [pid 1313] <... close resumed>) = 0 [pid 297] openat(AT_FDCWD, "./33/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1313] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 4 [pid 296] unlink("./34/binderfs" [pid 1313] <... futex resumed>) = 0 [pid 297] newfstatat(4, "", [pid 296] <... unlink resumed>) = 0 [pid 1313] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 297] getdents64(4, [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1309] exit_group(0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] close(3 [pid 1314] <... futex resumed>) = ? [pid 1313] <... futex resumed>) = ? [pid 1309] <... exit_group resumed>) = ? [pid 297] getdents64(4, [pid 296] <... close resumed>) = 0 [pid 1314] +++ exited with 0 +++ [pid 296] rmdir("./34" [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./35", 0777 [pid 297] close(4 [pid 296] <... mkdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] rmdir("./33/file1" [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1329 [pid 297] close(3) = 0 [pid 297] rmdir("./33") = 0 [pid 1324] mkdir("./bus", 0777 [pid 297] mkdir("./34", 0777 [pid 1327] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1324] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1327] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1324] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... mkdir resumed>) = 0 [pid 1327] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1327] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1327] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 297] <... openat resumed>) = 3 [pid 1327] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] ioctl(3, LOOP_CLR_FD [pid 1327] <... clone3 resumed> => {parent_tid=[1330]}, 88) = 1330 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1327] rt_sigprocmask(SIG_SETMASK, [], [pid 297] close(3 [pid 1327] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1327] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... close resumed>) = 0 [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1327] <... futex resumed>) = 0 [pid 1327] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1327] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1327] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1327] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1331 [pid 1327] <... clone3 resumed> => {parent_tid=[1332]}, 88) = 1332 [pid 1327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1327] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1331 attached [pid 1331] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1331] chdir("./34") = 0 [pid 1331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1331] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 1328 attached ./strace-static-x86_64: Process 1332 attached ./strace-static-x86_64: Process 1330 attached ./strace-static-x86_64: Process 1329 attached [pid 1328] set_robust_list(0x555556d8d6a0, 24 [pid 1331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1328] <... set_robust_list resumed>) = 0 [pid 1332] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1329] set_robust_list(0x555556d8d6a0, 24 [pid 1331] <... openat resumed>) = 3 [pid 1331] write(3, "1000", 4) = 4 [pid 1331] close(3) = 0 [pid 1331] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1328] chdir("./37" [pid 1329] <... set_robust_list resumed>) = 0 [pid 1332] <... set_robust_list resumed>) = 0 [pid 1330] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1331] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1331] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1331] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1331] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1333]}, 88) = 1333 [pid 1328] <... chdir resumed>) = 0 [pid 1331] rt_sigprocmask(SIG_SETMASK, [], [pid 1329] chdir("./35" [pid 1328] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1332] rt_sigprocmask(SIG_SETMASK, [], [pid 1330] <... set_robust_list resumed>) = 0 [pid 1331] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1331] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1331] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1334]}, 88) = 1334 [pid 1329] <... chdir resumed>) = 0 [pid 1328] <... prctl resumed>) = 0 [pid 1331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1331] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] setpgid(0, 0 [pid 1331] <... futex resumed>) = 0 [pid 1329] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1334 attached [pid 1334] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1334] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1328] <... setpgid resumed>) = 0 [pid 1329] <... prctl resumed>) = 0 [pid 1328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1332] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1329] setpgid(0, 0 [pid 1328] <... openat resumed>) = 3 [pid 1329] <... setpgid resumed>) = 0 [pid 1332] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1328] write(3, "1000", 4 [pid 1329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1332] <... open resumed>) = 3 [pid 1328] <... write resumed>) = 4 [pid 1329] <... openat resumed>) = 3 [pid 1332] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] close(3 [pid 1334] <... open resumed>) = 3 [pid 1334] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1331] <... futex resumed>) = 0 [pid 1331] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1332] <... futex resumed>) = 1 [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1329] write(3, "1000", 4 [pid 1328] <... close resumed>) = 0 [pid 1327] <... futex resumed>) = 0 [pid 1327] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1332] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1330] rt_sigprocmask(SIG_SETMASK, [], [pid 1329] <... write resumed>) = 4 [pid 1328] symlink("/dev/binderfs", "./binderfs" [pid 1327] <... futex resumed>) = 0 [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1329] close(3 [pid 1328] <... symlink resumed>) = 0 [pid 1332] <... mount resumed>) = 0 [pid 1328] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1332] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1329] <... close resumed>) = 0 [pid 1334] <... futex resumed>) = 1 [pid 1334] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1334] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1332] <... futex resumed>) = 1 [pid 1331] <... futex resumed>) = 0 [pid 1329] symlink("/dev/binderfs", "./binderfs" [pid 1328] <... futex resumed>) = 0 [pid 1327] <... futex resumed>) = 0 [pid 1331] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1330] memfd_create("syzkaller", 0 [pid 1327] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1331] <... futex resumed>) = 0 [pid 1329] <... symlink resumed>) = 0 [pid 1327] <... futex resumed>) = 0 [pid 1328] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1332] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1330] <... memfd_create resumed>) = 4 [pid 1329] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1332] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1330] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1329] <... futex resumed>) = 0 [pid 1328] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1327] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1332] <... futex resumed>) = 0 [pid 1330] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1329] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1327] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1332] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1329] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1327] <... futex resumed>) = 0 [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1332] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1329] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1334] <... futex resumed>) = 1 [pid 1334] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1334] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1331] <... futex resumed>) = 0 [pid 1331] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1334] <... futex resumed>) = 1 [pid 1334] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1332] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1328] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1332] <... futex resumed>) = 1 [pid 1329] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1328] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1327] <... futex resumed>) = 0 [pid 1332] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1329] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1328] <... mprotect resumed>) = 0 [pid 1327] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1332] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1329] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1327] <... futex resumed>) = 0 [pid 1332] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1329] <... mprotect resumed>) = 0 [pid 1328] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1327] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1334] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1329] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1332] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1330] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1329] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1328] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1334] <... futex resumed>) = 1 [pid 1332] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1331] <... futex resumed>) = 0 [pid 1329] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1334] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1331] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1334] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1331] <... futex resumed>) = 0 [pid 1334] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1331] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1334] <... futex resumed>) = 0 [pid 1332] <... futex resumed>) = 1 [pid 1331] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1329] <... clone3 resumed> => {parent_tid=[1336]}, 88) = 1336 [pid 1327] <... futex resumed>) = 0 [pid 1334] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1332] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1329] rt_sigprocmask(SIG_SETMASK, [], [pid 1328] <... clone3 resumed> => {parent_tid=[1337]}, 88) = 1337 [pid 1329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1328] rt_sigprocmask(SIG_SETMASK, [], [pid 1329] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1329] <... futex resumed>) = 0 [pid 1328] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1336 attached [pid 1336] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1329] <... futex resumed>) = 0 [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1329] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1328] <... futex resumed>) = 0 [pid 1329] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1329] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1328] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1329] <... mprotect resumed>) = 0 [pid 1329] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1328] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1336] rt_sigprocmask(SIG_SETMASK, [], [pid 1329] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1328] <... mprotect resumed>) = 0 [pid 1336] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1329] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1328] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1336] memfd_create("syzkaller", 0 [pid 1328] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1336] <... memfd_create resumed>) = 3 [pid 1329] <... clone3 resumed> => {parent_tid=[1339]}, 88) = 1339 [pid 1328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1336] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1329] rt_sigprocmask(SIG_SETMASK, [], [pid 1336] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1330] <... write resumed>) = 262144 [pid 1329] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] <... clone3 resumed> => {parent_tid=[1340]}, 88) = 1340 ./strace-static-x86_64: Process 1340 attached ./strace-static-x86_64: Process 1339 attached ./strace-static-x86_64: Process 1337 attached ./strace-static-x86_64: Process 1333 attached [ 32.974193][ T1324] loop1: detected capacity change from 0 to 512 [pid 1330] munmap(0x7f0c41dcd000, 138412032 [pid 1329] <... futex resumed>) = 0 [pid 1328] rt_sigprocmask(SIG_SETMASK, [], [pid 1340] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1339] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1337] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1336] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1333] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1330] <... munmap resumed>) = 0 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1313] +++ exited with 0 +++ [pid 1309] +++ exited with 0 +++ [pid 1340] <... set_robust_list resumed>) = 0 [pid 1339] <... set_robust_list resumed>) = 0 [pid 1337] <... set_robust_list resumed>) = 0 [pid 1336] <... write resumed>) = 262144 [pid 1333] <... set_robust_list resumed>) = 0 [pid 1330] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1328] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1309, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 1340] rt_sigprocmask(SIG_SETMASK, [], [pid 1339] rt_sigprocmask(SIG_SETMASK, [], [pid 1337] rt_sigprocmask(SIG_SETMASK, [], [pid 1336] munmap(0x7f0c41dcd000, 138412032 [pid 1333] rt_sigprocmask(SIG_SETMASK, [], [pid 1330] <... openat resumed>) = 6 [pid 1328] <... futex resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 1340] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1339] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1336] <... munmap resumed>) = 0 [pid 1333] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1330] ioctl(6, LOOP_SET_FD, 4 [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... restart_syscall resumed>) = 0 [pid 1340] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1339] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1337] memfd_create("syzkaller", 0 [pid 1336] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1333] memfd_create("syzkaller", 0 [pid 1330] <... ioctl resumed>) = 0 [pid 1340] <... open resumed>) = 3 [pid 1339] <... open resumed>) = 4 [pid 1337] <... memfd_create resumed>) = 4 [pid 1336] <... openat resumed>) = 5 [pid 1333] <... memfd_create resumed>) = 5 [pid 1330] close(4 [pid 1340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1339] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1336] ioctl(5, LOOP_SET_FD, 3 [pid 1333] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1330] <... close resumed>) = 0 [pid 298] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1340] <... futex resumed>) = 1 [pid 1339] <... futex resumed>) = 1 [pid 1337] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1336] <... ioctl resumed>) = 0 [pid 1333] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1330] mkdir("./file1", 0777 [pid 1329] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1340] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1339] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1337] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1336] close(3 [pid 1333] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1330] <... mkdir resumed>) = 0 [pid 1329] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1337] <... write resumed>) = 262144 [pid 1336] <... close resumed>) = 0 [pid 1333] <... write resumed>) = 262144 [pid 1330] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1329] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 1340] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1339] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1337] munmap(0x7f0c41dcd000, 138412032 [pid 1336] mkdir("./bus", 0777 [pid 1333] munmap(0x7f0c41dcd000, 138412032 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] newfstatat(3, "", [pid 1340] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1339] <... mount resumed>) = 0 [pid 1337] <... munmap resumed>) = 0 [pid 1333] <... munmap resumed>) = 0 [pid 1336] <... mkdir resumed>) = -1 EEXIST (File exists) [ 33.028916][ T1324] EXT4-fs (loop1): 1 orphan inode deleted [ 33.043239][ T1324] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.043361][ T1330] loop0: detected capacity change from 0 to 512 [ 33.056547][ T1324] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/33/bus supports timestamps until 2038 (0x7fffffff) [ 33.071051][ T1336] loop2: detected capacity change from 0 to 512 [pid 1324] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1339] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1337] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1336] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1333] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1324] ioctl(6, LOOP_CLR_FD [pid 298] getdents64(3, [pid 1340] <... futex resumed>) = 1 [pid 1339] <... futex resumed>) = 1 [pid 1337] <... openat resumed>) = 5 [pid 1333] <... openat resumed>) = 6 [pid 1329] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 0 [pid 1324] <... ioctl resumed>) = 0 [pid 1340] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1339] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1337] ioctl(5, LOOP_SET_FD, 4 [pid 1333] ioctl(6, LOOP_SET_FD, 5 [pid 1329] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1324] close(6 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1340] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1339] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1329] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 0 [pid 1324] <... close resumed>) = 0 [pid 298] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1340] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1339] <... open resumed>) = 3 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1324] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1339] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1337] <... ioctl resumed>) = 0 [pid 1333] <... ioctl resumed>) = 0 [pid 1329] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1328] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... umount2 resumed>) = 0 [pid 1340] <... futex resumed>) = 0 [pid 1339] <... futex resumed>) = 0 [pid 1337] close(4 [pid 1333] close(5 [pid 1329] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1328] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1324] <... futex resumed>) = 0 [pid 1320] exit_group(0 [pid 298] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1340] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1339] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1329] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 0 [pid 1326] <... futex resumed>) = ? [pid 1320] <... exit_group resumed>) = ? [pid 1340] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1339] <... write resumed>) = 8 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1326] +++ exited with 0 +++ [pid 1324] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1337] <... close resumed>) = 0 [pid 1337] mkdir("./file1", 0777) = -1 EEXIST (File exists) [pid 1337] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1333] <... close resumed>) = 0 [pid 1333] mkdir("./file1", 0777) = 0 [pid 1333] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1340] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1339] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1339] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1329] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1329] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1339] <... futex resumed>) = 0 [pid 1329] <... futex resumed>) = 1 [pid 1339] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1329] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1328] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 33.092048][ T1337] loop5: detected capacity change from 0 to 512 [ 33.098329][ T1333] loop3: detected capacity change from 0 to 512 [ 33.111724][ T1330] EXT4-fs (loop0): 1 orphan inode deleted [ 33.118610][ T1330] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.119101][ T1336] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 298] newfstatat(AT_FDCWD, "./33/bus", [pid 1339] <... write resumed>) = 1045 [pid 1328] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1340] <... futex resumed>) = 0 [pid 1328] <... futex resumed>) = 1 [pid 298] unlink("./33/bus" [pid 1340] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1328] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 1340] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 298] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1340] <... futex resumed>) = 1 [pid 1328] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./33/binderfs", [pid 1340] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./33/binderfs") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./33") = 0 [pid 298] mkdir("./34", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1347 [pid 1339] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1329] <... futex resumed>) = 0 [pid 1339] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1347 attached [pid 1347] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1347] chdir("./34") = 0 [pid 1347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1347] setpgid(0, 0) = 0 [pid 1347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1347] write(3, "1000", 4) = 4 [ 33.129569][ T1330] ext4 filesystem being mounted at /root/syzkaller.iF59aB/36/file1 supports timestamps until 2038 (0x7fffffff) [ 33.149543][ T1337] EXT4-fs (loop5): 1 orphan inode deleted [ 33.159976][ T1337] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.162270][ T1333] EXT4-fs (loop3): 1 orphan inode deleted [ 33.171807][ T1337] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/37/file1 supports timestamps until 2038 (0x7fffffff) [pid 1347] close(3) = 0 [pid 1330] <... mount resumed>) = 0 [pid 1320] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1320, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1347] symlink("/dev/binderfs", "./binderfs" [pid 1330] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 1347] <... symlink resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 1330] chdir("./file1" [pid 1347] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1330] <... chdir resumed>) = 0 [pid 1347] <... futex resumed>) = 0 [pid 1330] ioctl(6, LOOP_CLR_FD [pid 1347] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1330] <... ioctl resumed>) = 0 [pid 1347] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1330] close(6 [pid 1347] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1330] <... close resumed>) = 0 [pid 1347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1330] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1330] <... futex resumed>) = 0 [pid 1347] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1330] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1347] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 295] umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] newfstatat(AT_FDCWD, "./33/bus", [pid 1347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1327] exit_group(0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1332] <... futex resumed>) = ? [pid 1330] <... futex resumed>) = ? [pid 1327] <... exit_group resumed>) = ? [pid 295] unlink("./33/bus" [pid 1347] <... clone3 resumed> => {parent_tid=[1350]}, 88) = 1350 [pid 1332] +++ exited with 0 +++ [pid 1330] +++ exited with 0 +++ [pid 1327] +++ exited with 0 +++ [pid 295] <... unlink resumed>) = 0 [pid 1347] rt_sigprocmask(SIG_SETMASK, [], [pid 295] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1327, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1347] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./33/binderfs", [pid 1347] <... futex resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./33/binderfs" [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1347] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 294] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 294] <... openat resumed>) = 3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] newfstatat(3, "", [pid 295] close(3 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... close resumed>) = 0 [pid 294] getdents64(3, [pid 295] rmdir("./33" [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... rmdir resumed>) = 0 [pid 294] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] mkdir("./34", 0777 [pid 294] <... umount2 resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1350 attached [pid 1347] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] <... openat resumed>) = 3 [pid 294] newfstatat(AT_FDCWD, "./36/bus", [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] unlink("./36/bus" [pid 295] close(3 [pid 294] <... unlink resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 294] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./36/binderfs", ./strace-static-x86_64: Process 1351 attached [pid 1350] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1347] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1337] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1333] <... mount resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1351 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1351] set_robust_list(0x555556d8d6a0, 24 [pid 1350] <... set_robust_list resumed>) = 0 [pid 1347] <... mprotect resumed>) = 0 [pid 1337] ioctl(5, LOOP_CLR_FD [pid 1336] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1333] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 294] unlink("./36/binderfs" [pid 1351] <... set_robust_list resumed>) = 0 [pid 1350] rt_sigprocmask(SIG_SETMASK, [], [pid 1347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1336] ioctl(5, LOOP_CLR_FD [pid 1333] <... openat resumed>) = 5 [pid 294] <... unlink resumed>) = 0 [pid 1351] chdir("./34" [pid 1350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1336] <... ioctl resumed>) = 0 [pid 1333] chdir("./file1" [pid 294] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1351] <... chdir resumed>) = 0 [pid 1350] memfd_create("syzkaller", 0 [pid 1347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1336] close(5 [pid 1333] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 1352 attached [pid 1351] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1350] <... memfd_create resumed>) = 3 [pid 1336] <... close resumed>) = 0 [pid 1333] ioctl(6, LOOP_CLR_FD [pid 1352] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1351] <... prctl resumed>) = 0 [pid 1350] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1347] <... clone3 resumed> => {parent_tid=[1352]}, 88) = 1352 [pid 1336] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1333] <... ioctl resumed>) = 0 [pid 1352] <... set_robust_list resumed>) = 0 [pid 1351] setpgid(0, 0 [pid 1350] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1347] rt_sigprocmask(SIG_SETMASK, [], [pid 1336] <... futex resumed>) = 0 [pid 1333] close(6 [pid 1352] rt_sigprocmask(SIG_SETMASK, [], [pid 1351] <... setpgid resumed>) = 0 [pid 1350] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1336] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1333] <... close resumed>) = 0 [pid 1352] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1333] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1351] <... openat resumed>) = 3 [pid 1350] <... write resumed>) = 262144 [pid 1347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1333] <... futex resumed>) = 0 [pid 1329] exit_group(0 [pid 1351] write(3, "1000", 4 [pid 1333] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1331] exit_group(0 [pid 1347] <... futex resumed>) = 0 [pid 1351] <... write resumed>) = 4 [pid 1339] <... futex resumed>) = ? [pid 1336] <... futex resumed>) = ? [pid 1334] <... futex resumed>) = ? [pid 1331] <... exit_group resumed>) = ? [pid 1329] <... exit_group resumed>) = ? [pid 1333] <... futex resumed>) = ? [pid 1351] close(3 [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1339] +++ exited with 0 +++ [pid 1351] <... close resumed>) = 0 [pid 1336] +++ exited with 0 +++ [pid 1334] +++ exited with 0 +++ [pid 1351] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1333] +++ exited with 0 +++ [pid 1351] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1351] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1351] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1351] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1351] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1331] +++ exited with 0 +++ [pid 1351] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1331, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1351] <... clone3 resumed> => {parent_tid=[1353]}, 88) = 1353 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 1351] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... restart_syscall resumed>) = 0 [pid 1351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1350] munmap(0x7f0c41dcd000, 138412032 [pid 1351] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1351] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1351] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1354]}, 88) = 1354 [pid 1351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1351] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1352] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1352] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1347] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1354 attached ./strace-static-x86_64: Process 1353 attached [pid 1350] <... munmap resumed>) = 0 [pid 1347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1354] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1353] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1352] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1350] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1347] <... futex resumed>) = 0 [pid 1354] <... set_robust_list resumed>) = 0 [pid 1353] <... set_robust_list resumed>) = 0 [pid 1352] <... mount resumed>) = 0 [pid 1350] <... openat resumed>) = 5 [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1354] rt_sigprocmask(SIG_SETMASK, [], [pid 1353] rt_sigprocmask(SIG_SETMASK, [], [ 33.176839][ T1333] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.219702][ T1336] EXT4-fs (loop2): get root inode failed [ 33.225168][ T1336] EXT4-fs (loop2): mount failed [ 33.228782][ T1333] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/34/file1 supports timestamps until 2038 (0x7fffffff) [pid 1350] ioctl(5, LOOP_SET_FD, 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1354] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1352] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1354] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1352] <... futex resumed>) = 1 [pid 1354] <... open resumed>) = 3 [pid 1352] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1354] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1353] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1350] <... ioctl resumed>) = 0 [pid 1347] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 1352] <... futex resumed>) = 0 [pid 1347] <... futex resumed>) = 1 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1352] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] getdents64(3, [pid 1352] <... open resumed>) = 6 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1352] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1352] <... futex resumed>) = 1 [pid 1347] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 1352] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1352] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1347] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1352] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./34/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./34/bus" [pid 1354] <... futex resumed>) = 1 [pid 1353] memfd_create("syzkaller", 0 [pid 1351] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 1354] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1352] <... write resumed>) = 8 [pid 1351] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1350] close(3 [pid 297] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1354] <... mount resumed>) = 0 [pid 1352] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1351] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1354] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1352] <... futex resumed>) = 1 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1347] <... futex resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./34/binderfs", [pid 1353] <... memfd_create resumed>) = 4 [pid 1354] <... futex resumed>) = 0 [pid 1352] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1351] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1354] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1351] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1347] <... futex resumed>) = 0 [pid 297] unlink("./34/binderfs" [pid 1352] <... write resumed>) = 1045 [pid 1354] <... open resumed>) = 5 [pid 1353] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1352] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1351] <... futex resumed>) = 0 [pid 1347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... unlink resumed>) = 0 [pid 1354] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1352] <... futex resumed>) = 0 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1347] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1354] <... futex resumed>) = 0 [pid 1353] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1352] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1351] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1350] <... close resumed>) = 0 [pid 1354] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1351] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1351] <... futex resumed>) = 0 [pid 1350] mkdir("./bus", 0777 [pid 1354] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1350] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1354] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1350] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1354] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1337] <... ioctl resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1337] close(5 [pid 294] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1337] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1353] <... write resumed>) = 262144 [pid 1337] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] newfstatat(AT_FDCWD, "./36/file1", [pid 1337] <... futex resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1353] munmap(0x7f0c41dcd000, 138412032 [pid 1337] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1353] <... munmap resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1328] exit_group(0 [pid 294] openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1353] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1340] <... futex resumed>) = ? [pid 1337] <... futex resumed>) = ? [pid 1328] <... exit_group resumed>) = ? [pid 294] <... openat resumed>) = 4 [pid 1353] <... openat resumed>) = 6 [pid 1340] +++ exited with 0 +++ [pid 1337] +++ exited with 0 +++ [pid 1328] +++ exited with 0 +++ [pid 294] newfstatat(4, "", [pid 1353] ioctl(6, LOOP_SET_FD, 4 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1328, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1354] <... futex resumed>) = 1 [pid 1351] <... futex resumed>) = 0 [pid 1350] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1354] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1351] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1350] ioctl(5, LOOP_CLR_FD [pid 1354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1351] <... futex resumed>) = 0 [pid 1350] <... ioctl resumed>) = 0 [pid 1354] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1351] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1350] close(5 [pid 1353] <... ioctl resumed>) = 0 [pid 294] getdents64(4, [pid 1353] close(4 [pid 299] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1353] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(4, [pid 1353] mkdir("./file1", 0777 [pid 299] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1353] <... mkdir resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 294] close(4 [pid 1353] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] rmdir("./36/file1" [pid 299] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] getdents64(3, [pid 299] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] close(3 [pid 299] newfstatat(AT_FDCWD, "./37/binderfs", [pid 294] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] rmdir("./36" [pid 299] unlink("./37/binderfs" [pid 294] <... rmdir resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 294] mkdir("./37", 0777 [pid 299] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... mkdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] newfstatat(AT_FDCWD, "./37/file1", [pid 294] <... openat resumed>) = 3 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] unlink("./37/file1" [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... unlink resumed>) = 0 [pid 294] close(3 [pid 299] getdents64(3, [pid 294] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] close(3) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1355 [pid 299] rmdir("./37") = 0 [pid 299] mkdir("./38", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 1350] <... close resumed>) = 0 [pid 1329] +++ exited with 0 +++ [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1350] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1356 [pid 1350] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1356 attached [pid 1356] set_robust_list(0x555556d8d6a0, 24 [pid 1347] exit_group(0 [pid 1352] <... futex resumed>) = ? [pid 1350] <... futex resumed>) = ? [pid 1347] <... exit_group resumed>) = ? [pid 1352] +++ exited with 0 +++ [pid 1356] <... set_robust_list resumed>) = 0 [pid 1356] chdir("./38") = 0 [pid 1356] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1356] setpgid(0, 0./strace-static-x86_64: Process 1355 attached ) = 0 [pid 1354] <... write resumed>) = -1 EIO (Input/output error) [pid 1354] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1329, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1354] <... futex resumed>) = 1 [pid 1351] <... futex resumed>) = 0 [pid 1356] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1355] set_robust_list(0x555556d8d6a0, 24 [pid 1354] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1356] <... openat resumed>) = 3 [pid 1355] <... set_robust_list resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./34/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(3, "", [pid 297] openat(AT_FDCWD, "./34/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... openat resumed>) = 4 [pid 296] getdents64(3, [pid 297] newfstatat(4, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1356] write(3, "1000", 4 [pid 1355] chdir("./37" [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1356] <... write resumed>) = 4 [pid 1355] <... chdir resumed>) = 0 [pid 297] getdents64(4, [pid 1356] close(3 [pid 1355] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... umount2 resumed>) = 0 [pid 297] getdents64(4, [pid 296] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./35/bus", [pid 297] rmdir("./34/file1" [pid 1356] <... close resumed>) = 0 [pid 1355] <... prctl resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 296] unlink("./35/bus" [pid 1356] symlink("/dev/binderfs", "./binderfs" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 296] <... unlink resumed>) = 0 [pid 297] rmdir("./34" [pid 296] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1356] <... symlink resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1356] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1355] setpgid(0, 0 [pid 297] mkdir("./35", 0777 [pid 296] newfstatat(AT_FDCWD, "./35/binderfs", [pid 1356] <... futex resumed>) = 0 [pid 1355] <... setpgid resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] unlink("./35/binderfs" [pid 1356] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 1356] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... unlink resumed>) = 0 [pid 1356] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] close(3 [pid 296] getdents64(3, [pid 1355] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] close(3 [pid 1356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1355] write(3, "1000", 4 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1357 ./strace-static-x86_64: Process 1357 attached [pid 1356] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1355] <... write resumed>) = 4 [pid 296] <... close resumed>) = 0 [pid 1350] +++ exited with 0 +++ [pid 1347] +++ exited with 0 +++ [pid 296] rmdir("./35" [pid 1357] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1357] chdir("./35") = 0 [pid 1357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1357] setpgid(0, 0) = 0 [pid 1357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1357] write(3, "1000", 4) = 4 [pid 1357] close(3) = 0 [pid 1357] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1357] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1357] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1357] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] <... rmdir resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1347, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1357] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1357] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] mkdir("./36", 0777 [pid 298] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 1357] <... mprotect resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 33.264394][ T1350] loop4: detected capacity change from 0 to 512 [ 33.278858][ T1350] EXT4-fs (loop4): Invalid log block size: 2475723007 [ 33.284011][ T1353] loop1: detected capacity change from 0 to 512 [ 33.290963][ T54] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] getdents64(3, [pid 296] <... openat resumed>) = 3 [pid 1356] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] ioctl(3, LOOP_CLR_FD [pid 1356] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1360]}, 88) = 1360 [pid 1356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1356] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1356] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1356] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1361]}, 88) = 1361 [pid 1356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1356] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1355] close(3) = 0 [pid 1355] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1355] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1355] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1355] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1355] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1355] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1362]}, 88) = 1362 [pid 1355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1355] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1355] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1355] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1363]}, 88) = 1363 [pid 1355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1355] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 298] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1364 attached ./strace-static-x86_64: Process 1363 attached ./strace-static-x86_64: Process 1362 attached ./strace-static-x86_64: Process 1361 attached ./strace-static-x86_64: Process 1360 attached [pid 1357] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(AT_FDCWD, "./34/bus", [pid 1364] set_robust_list(0x555556d8d6a0, 24 [pid 1363] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1362] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1361] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1360] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1357] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1364 [pid 1353] <... mount resumed>) = 0 [pid 1353] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 1353] chdir("./file1") = 0 [pid 1353] ioctl(6, LOOP_CLR_FD) = 0 [pid 1353] close(6) = 0 [pid 1353] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1353] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1351] exit_group(0 [pid 1362] <... set_robust_list resumed>) = 0 [pid 1360] <... set_robust_list resumed>) = 0 [pid 1361] <... set_robust_list resumed>) = 0 [pid 1357] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1363] <... set_robust_list resumed>) = 0 [pid 1362] rt_sigprocmask(SIG_SETMASK, [], [pid 1361] rt_sigprocmask(SIG_SETMASK, [], [pid 1360] rt_sigprocmask(SIG_SETMASK, [], [pid 1354] <... futex resumed>) = ? [pid 1351] <... exit_group resumed>) = ? [pid 298] unlink("./34/bus" [pid 1364] <... set_robust_list resumed>) = 0 [pid 1363] rt_sigprocmask(SIG_SETMASK, [], [pid 1362] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1354] +++ exited with 0 +++ [pid 1360] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1363] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1361] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1362] memfd_create("syzkaller", 0 [pid 1361] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1363] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1360] memfd_create("syzkaller", 0 [pid 298] <... unlink resumed>) = 0 [pid 1363] <... open resumed>) = 3 [pid 1364] chdir("./36" [pid 1361] <... open resumed>) = 3 [pid 1360] <... memfd_create resumed>) = 4 [pid 1357] <... clone3 resumed> => {parent_tid=[1365]}, 88) = 1365 [pid 1360] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1364] <... chdir resumed>) = 0 [pid 1362] <... memfd_create resumed>) = 4 [pid 1357] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1360] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1363] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1361] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1360] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1364] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1362] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1357] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1364] <... prctl resumed>) = 0 [pid 1363] <... futex resumed>) = 1 [pid 1362] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1361] <... futex resumed>) = 1 [pid 1357] <... futex resumed>) = 0 [pid 1356] <... futex resumed>) = 0 [pid 1355] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./34/binderfs", [pid 1356] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1355] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1355] <... futex resumed>) = 0 [pid 1356] <... futex resumed>) = 0 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1357] <... futex resumed>) = 0 [pid 1364] setpgid(0, 0 [pid 1357] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1364] <... setpgid resumed>) = 0 [pid 1363] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1364] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1361] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1357] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1363] <... mount resumed>) = 0 [pid 1357] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1361] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1357] <... mprotect resumed>) = 0 [pid 298] unlink("./34/binderfs" [pid 1364] <... openat resumed>) = 3 [pid 1357] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... unlink resumed>) = 0 [pid 1357] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1364] write(3, "1000", 4 [pid 1363] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1361] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1357] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1361] <... futex resumed>) = 1 [pid 1356] <... futex resumed>) = 0 [pid 1356] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1357] <... clone3 resumed> => {parent_tid=[1366]}, 88) = 1366 [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1361] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1363] <... futex resumed>) = 1 [pid 1355] <... futex resumed>) = 0 [pid 1364] <... write resumed>) = 4 [pid 298] getdents64(3, [pid 1360] <... write resumed>) = 262144 [pid 1355] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1357] rt_sigprocmask(SIG_SETMASK, [], [pid 1363] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1361] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1364] close(3 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1357] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1363] <... open resumed>) = 5 [pid 1361] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1357] <... futex resumed>) = 0 [pid 1364] <... close resumed>) = 0 [pid 1361] <... futex resumed>) = 1 [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1356] <... futex resumed>) = 0 [pid 1364] symlink("/dev/binderfs", "./binderfs" [pid 1363] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1361] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] close(3 [pid 1356] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1362] <... write resumed>) = 262144 [pid 1361] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1363] <... futex resumed>) = 1 [pid 1355] <... futex resumed>) = 0 [pid 1364] <... symlink resumed>) = 0 [pid 1363] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1361] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1355] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 1364] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1363] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1361] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1355] <... futex resumed>) = 0 [pid 298] rmdir("./34" [pid 1364] <... futex resumed>) = 0 [pid 1364] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1363] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] munmap(0x7f0c41dcd000, 138412032 [pid 1361] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1360] munmap(0x7f0c41dcd000, 138412032 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 1364] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1363] <... futex resumed>) = 0 [pid 1361] <... futex resumed>) = 1 [pid 1356] <... futex resumed>) = 0 [pid 1355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1356] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1364] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1363] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1361] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1355] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./35", 0777 [pid 1364] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1363] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1356] <... futex resumed>) = 0 [pid 1356] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1355] <... futex resumed>) = 0 [pid 1355] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1361] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1363] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1364] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 1366 attached [pid 1366] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1366] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 298] <... mkdir resumed>) = 0 [pid 1363] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1361] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1364] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1363] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1361] <... futex resumed>) = 1 [pid 1356] <... futex resumed>) = 0 [pid 1363] <... futex resumed>) = 1 [pid 1355] <... futex resumed>) = 0 [pid 1361] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1364] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1363] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... openat resumed>) = 3 [pid 1364] <... mprotect resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 1366] <... open resumed>) = 3 [pid 1366] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1357] <... futex resumed>) = 0 [pid 1357] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1366] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1366] <... mount resumed>) = 0 [pid 1366] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1357] <... futex resumed>) = 0 [pid 1366] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1364] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1357] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1364] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1364] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1353] <... futex resumed>) = ? [pid 1353] +++ exited with 0 +++ [pid 1351] +++ exited with 0 +++ [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1364] <... clone3 resumed> => {parent_tid=[1367]}, 88) = 1367 [pid 298] close(3 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1351, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] <... close resumed>) = 0 [pid 295] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1364] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1368 attached ./strace-static-x86_64: Process 1365 attached [pid 1366] <... futex resumed>) = 0 [pid 1364] <... futex resumed>) = 0 [pid 1362] <... munmap resumed>) = 0 [pid 1360] <... munmap resumed>) = 0 [pid 295] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1368] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1368] chdir("./35") = 0 [pid 1368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1368] setpgid(0, 0) = 0 [pid 1368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1368] write(3, "1000", 4) = 4 [pid 1368] close(3) = 0 [pid 1368] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1368] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 1364] <... futex resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1368 [pid 1360] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] newfstatat(3, "", [pid 1364] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1362] <... openat resumed>) = 6 [pid 1360] <... openat resumed>) = 5 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1368] <... futex resumed>) = 0 [pid 1366] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1364] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] getdents64(3, [pid 1364] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1368] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1366] <... open resumed>) = 4 [pid 1364] <... mprotect resumed>) = 0 [pid 1368] <... rt_sigaction resumed>NULL, 8) = 0 [ 33.328838][ T1353] EXT4-fs (loop1): 1 orphan inode deleted [ 33.334685][ T1353] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.348703][ T1353] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/34/file1 supports timestamps until 2038 (0x7fffffff) [pid 1366] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1368] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1366] <... futex resumed>) = 1 [pid 1364] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1357] <... futex resumed>) = 0 [pid 1368] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1366] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1364] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1357] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1366] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1364] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1360] ioctl(5, LOOP_SET_FD, 4 [pid 1368] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1366] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1362] ioctl(6, LOOP_SET_FD, 4 [pid 1357] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 1368] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1366] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1368] <... mprotect resumed>) = 0 [pid 1366] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1368] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1366] <... futex resumed>) = 0 [pid 1368] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1366] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1368] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1370]}, 88) = 1370 [pid 1368] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1368] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1368] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1368] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1368] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1371]}, 88) = 1371 [pid 1368] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1368] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1365] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1365] memfd_create("syzkaller", 0) = 5 [pid 1365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1365] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1365] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1365] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 1365] ioctl(6, LOOP_SET_FD, 5 [pid 1364] <... clone3 resumed> => {parent_tid=[1369]}, 88) = 1369 [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1365] <... ioctl resumed>) = 0 [pid 1365] close(5) = 0 [pid 1365] mkdir("./file1", 0777) = 0 [pid 1365] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1367 attached [pid 1367] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1367] memfd_create("syzkaller", 0) = 3 [pid 1367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1367] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1367] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 1367] ioctl(4, LOOP_SET_FD, 3 [pid 1364] rt_sigprocmask(SIG_SETMASK, [], [pid 1357] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1357] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./34/bus", [pid 1364] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1366] <... futex resumed>) = 0 [pid 1357] <... futex resumed>) = 1 [pid 1367] <... ioctl resumed>) = 0 [pid 1366] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1357] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1364] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1367] close(3) = 0 [pid 1367] mkdir("./file1", 0777) = 0 [pid 1366] <... write resumed>) = 1045 [pid 1364] <... futex resumed>) = 0 [pid 295] unlink("./34/bus" [pid 1367] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1366] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1366] <... futex resumed>) = 1 [pid 1357] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1366] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./34/binderfs"./strace-static-x86_64: Process 1369 attached [pid 1369] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1369] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1369] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1369] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1369] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1360] <... ioctl resumed>) = 0 [pid 1360] close(4) = 0 [pid 1360] mkdir("./file1", 0777) = -1 EEXIST (File exists) [pid 1360] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1364] <... futex resumed>) = 0 [pid 1364] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1370 attached [pid 1369] <... futex resumed>) = 0 [pid 1370] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1370] memfd_create("syzkaller", 0) = 3 [pid 1370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1370] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1370] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1370] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 1370] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1371 attached [pid 1369] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1365] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1362] <... ioctl resumed>) = 0 [pid 1371] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1369] <... mount resumed>) = 0 [pid 1371] <... set_robust_list resumed>) = 0 [pid 1370] <... ioctl resumed>) = 0 [pid 1369] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1365] ioctl(6, LOOP_CLR_FD [pid 1362] close(4 [pid 1371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1369] <... futex resumed>) = 1 [pid 1364] <... futex resumed>) = 0 [pid 1362] <... close resumed>) = 0 [pid 1362] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1371] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1369] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1364] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1371] <... open resumed>) = 5 [pid 1364] <... futex resumed>) = 0 [pid 1369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1369] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1370] close(3 [pid 1365] <... ioctl resumed>) = 0 [pid 1370] <... close resumed>) = 0 [pid 1370] mkdir("./bus", 0777 [pid 1365] close(6 [pid 1370] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1371] <... futex resumed>) = 1 [pid 1370] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1369] <... open resumed>) = 5 [pid 1368] <... futex resumed>) = 0 [pid 1365] <... close resumed>) = 0 [pid 1371] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1369] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1368] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1369] <... futex resumed>) = 1 [pid 1368] <... futex resumed>) = 0 [pid 1364] <... futex resumed>) = 0 [pid 1371] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1369] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1364] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] <... mount resumed>) = 0 [pid 1369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1364] <... futex resumed>) = 0 [ 33.392780][ T1360] loop5: detected capacity change from 0 to 512 [ 33.398468][ T1365] loop3: detected capacity change from 0 to 512 [ 33.399339][ T1362] loop0: detected capacity change from 0 to 512 [ 33.410394][ T1367] loop2: detected capacity change from 0 to 512 [ 33.419649][ T1365] EXT4-fs (loop3): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [ 33.427668][ T1370] loop4: detected capacity change from 0 to 512 [pid 1371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1369] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1371] <... futex resumed>) = 1 [pid 1368] <... futex resumed>) = 0 [pid 1371] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1368] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1368] <... futex resumed>) = 0 [pid 1371] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1371] <... open resumed>) = 3 [pid 1371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1368] <... futex resumed>) = 0 [pid 1371] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1368] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1369] <... write resumed>) = 8 [pid 1368] <... futex resumed>) = 0 [pid 1365] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1365] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1371] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1369] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1357] exit_group(0 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./34/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./34/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./34/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./34") = 0 [pid 295] mkdir("./35", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1377 [pid 1369] <... futex resumed>) = 1 [pid 1366] <... futex resumed>) = ? [pid 1365] <... futex resumed>) = ? [pid 1364] <... futex resumed>) = 0 [pid 1357] <... exit_group resumed>) = ? [pid 1365] +++ exited with 0 +++ ./strace-static-x86_64: Process 1377 attached [pid 1377] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1377] chdir("./35") = 0 [pid 1377] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1377] setpgid(0, 0) = 0 [pid 1377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1377] write(3, "1000", 4) = 4 [pid 1377] close(3) = 0 [pid 1377] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1377] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1377] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1377] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1377] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1379]}, 88) = 1379 [pid 1377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1377] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1377] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 33.447193][ T1367] EXT4-fs (loop2): 1 orphan inode deleted [ 33.453962][ T1360] EXT4-fs (loop5): 1 orphan inode deleted [ 33.460297][ T1360] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.469929][ T1367] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.472155][ T1360] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/38/file1 supports timestamps until 2038 (0x7fffffff) [pid 1377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1371] <... write resumed>) = 8 [pid 1369] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1366] +++ exited with 0 +++ [pid 1364] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1368] <... futex resumed>) = 0 [pid 1371] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1368] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1368] <... futex resumed>) = 0 [pid 1371] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1368] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1371] <... write resumed>) = 1045 [pid 1377] <... clone3 resumed> => {parent_tid=[1380]}, 88) = 1380 [pid 1371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1377] rt_sigprocmask(SIG_SETMASK, [], [pid 1371] <... futex resumed>) = 1 [pid 1369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1368] <... futex resumed>) = 0 [pid 1364] <... futex resumed>) = 0 [pid 1377] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1371] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1369] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1364] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1380 attached ./strace-static-x86_64: Process 1379 attached [pid 1377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1369] <... write resumed>) = 1045 [pid 1367] <... mount resumed>) = 0 [pid 1380] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1379] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1377] <... futex resumed>) = 0 [pid 1367] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1380] <... set_robust_list resumed>) = 0 [pid 1379] <... set_robust_list resumed>) = 0 [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1367] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1380] rt_sigprocmask(SIG_SETMASK, [], [pid 1379] rt_sigprocmask(SIG_SETMASK, [], [pid 1367] ioctl(4, LOOP_CLR_FD [pid 1380] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1379] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1367] <... ioctl resumed>) = 0 [pid 1380] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1379] memfd_create("syzkaller", 0 [pid 1367] close(4 [pid 1380] <... open resumed>) = 3 [pid 1379] <... memfd_create resumed>) = 4 [pid 1367] <... close resumed>) = 0 [pid 1380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1367] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1380] <... futex resumed>) = 1 [pid 1379] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1377] <... futex resumed>) = 0 [pid 1367] <... futex resumed>) = 0 [pid 1380] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1379] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1367] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1379] <... write resumed>) = 262144 [pid 1377] <... futex resumed>) = 0 [pid 1380] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1380] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 1380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1377] <... futex resumed>) = 0 [pid 1380] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1377] <... futex resumed>) = 0 [pid 1380] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1380] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 1380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1377] <... futex resumed>) = 0 [pid 1380] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1377] <... futex resumed>) = 0 [pid 1380] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1380] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1379] munmap(0x7f0c41dcd000, 138412032 [pid 1380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1379] <... munmap resumed>) = 0 [pid 1380] <... futex resumed>) = 1 [pid 1377] <... futex resumed>) = 0 [pid 1380] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1379] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1379] <... openat resumed>) = 5 [pid 1377] <... futex resumed>) = 0 [pid 1380] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1379] ioctl(5, LOOP_SET_FD, 4 [pid 1377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1380] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1369] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1357] +++ exited with 0 +++ [pid 1369] <... futex resumed>) = 1 [pid 1364] <... futex resumed>) = 0 [ 33.494350][ T1362] EXT4-fs (loop0): 1 orphan inode deleted [ 33.500546][ T1367] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/36/file1 supports timestamps until 2038 (0x7fffffff) [ 33.514717][ T1362] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.522843][ T1379] loop1: detected capacity change from 0 to 512 [ 33.532027][ T1362] ext4 filesystem being mounted at /root/syzkaller.iF59aB/37/bus supports timestamps until 2038 (0x7fffffff) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1357, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1369] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1364] exit_group(0 [pid 1369] <... futex resumed>) = ? [pid 1364] <... exit_group resumed>) = ? [pid 1369] +++ exited with 0 +++ [pid 297] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1379] <... ioctl resumed>) = 0 [pid 1379] close(4) = 0 [pid 1379] mkdir("./file1", 0777) = -1 EEXIST (File exists) [pid 1379] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1360] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 297] <... umount2 resumed>) = 0 [pid 1360] ioctl(5, LOOP_CLR_FD [pid 297] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./35/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1367] <... futex resumed>) = ? [pid 297] unlink("./35/bus" [pid 1380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1367] +++ exited with 0 +++ [pid 1364] +++ exited with 0 +++ [pid 297] <... unlink resumed>) = 0 [pid 1380] <... futex resumed>) = 1 [pid 1377] <... futex resumed>) = 0 [pid 297] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1364, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1380] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./35/binderfs") = 0 [pid 297] umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./35/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./35/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 4 [pid 296] <... openat resumed>) = 3 [pid 297] newfstatat(4, "", [pid 296] newfstatat(3, "", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, [pid 296] getdents64(3, [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] getdents64(4, [pid 296] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./35/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./35") = 0 [pid 297] mkdir("./36", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./36/bus", [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./36/bus" [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1383 [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./36/binderfs") = 0 [pid 296] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1383 attached [pid 1360] <... ioctl resumed>) = 0 [pid 1360] close(5) = 0 [pid 1360] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1360] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1356] exit_group(0 [pid 1361] <... futex resumed>) = ? [pid 1356] <... exit_group resumed>) = ? [pid 1361] +++ exited with 0 +++ [pid 1360] <... futex resumed>) = ? [pid 1383] set_robust_list(0x555556d8d6a0, 24 [pid 1360] +++ exited with 0 +++ [pid 1356] +++ exited with 0 +++ [pid 1383] <... set_robust_list resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1356, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 1383] chdir("./36" [pid 1370] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 1383] <... chdir resumed>) = 0 [pid 1370] ioctl(4, LOOP_CLR_FD [pid 1383] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1370] <... ioctl resumed>) = 0 [pid 1383] <... prctl resumed>) = 0 [pid 1370] close(4) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 299] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 299] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./38/binderfs") = 0 [pid 1383] setpgid(0, 0 [pid 1370] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1383] <... setpgid resumed>) = 0 [pid 1370] <... futex resumed>) = 0 [pid 1368] exit_group(0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 33.536578][ T1370] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 33.566402][ T1370] EXT4-fs (loop4): get root inode failed [ 33.572407][ T1370] EXT4-fs (loop4): mount failed [pid 1383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1371] <... futex resumed>) = ? [pid 1368] <... exit_group resumed>) = ? [pid 299] newfstatat(AT_FDCWD, "./38/file1", [pid 1383] <... openat resumed>) = 3 [pid 1371] +++ exited with 0 +++ [pid 1370] +++ exited with 0 +++ [pid 1383] write(3, "1000", 4 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1383] <... write resumed>) = 4 [pid 1383] close(3) = 0 [pid 1383] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1383] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1383] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1383] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1383] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1383] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1387]}, 88) = 1387 [pid 1383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1383] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1383] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1383] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1383] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1388]}, 88) = 1388 [pid 1383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1383] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1383] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] unlink("./38/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./38") = 0 [pid 299] mkdir("./39", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1389 ./strace-static-x86_64: Process 1387 attached [pid 1387] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1387] memfd_create("syzkaller", 0) = 3 [pid 1387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1387] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1387] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 1387] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1389 attached ./strace-static-x86_64: Process 1388 attached ) = 0 [pid 1387] close(3) = 0 [pid 1387] mkdir("./file1", 0777) = 0 [pid 1387] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1389] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1389] chdir("./39") = 0 [pid 1389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1389] setpgid(0, 0) = 0 [pid 1389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1389] write(3, "1000", 4) = 4 [pid 1389] close(3) = 0 [pid 1389] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1389] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1389] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1389] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1389] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1389] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1389] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1389] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1390]}, 88) = 1390 [pid 1389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1389] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1389] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1389] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1389] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1389] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1389] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1391]}, 88) = 1391 [pid 1389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1389] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1388] set_robust_list(0x7f0c4a1ed9a0, 24 [ 33.599208][ T1379] EXT4-fs (loop1): 1 orphan inode deleted [ 33.605304][ T1379] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.615811][ T1387] loop3: detected capacity change from 0 to 512 [ 33.617989][ T1379] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/35/file1 supports timestamps until 2038 (0x7fffffff) [ 33.634204][ T30] kauditd_printk_skb: 2 callbacks suppressed [pid 1389] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1388] <... set_robust_list resumed>) = 0 [pid 1383] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1368] +++ exited with 0 +++ [pid 1362] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 296] <... umount2 resumed>) = 0 [pid 1388] rt_sigprocmask(SIG_SETMASK, [], [pid 1383] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] ioctl(6, LOOP_CLR_FD [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1368, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1362] <... ioctl resumed>) = 0 [pid 1383] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1388] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1362] close(6 [pid 296] newfstatat(AT_FDCWD, "./36/file1", [pid 1388] <... open resumed>) = 3 [pid 1383] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 1362] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1362] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1383] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 296] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1388] <... futex resumed>) = 0 [pid 1383] <... mprotect resumed>) = 0 [pid 1362] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1362] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1355] exit_group(0 [pid 298] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1383] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1363] <... futex resumed>) = ? [pid 1362] <... futex resumed>) = ? [pid 1355] <... exit_group resumed>) = ? [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1383] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... openat resumed>) = 4 [pid 1383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 1363] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] newfstatat(4, "", [pid 298] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1383] <... clone3 resumed> => {parent_tid=[1393]}, 88) = 1393 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, [pid 1383] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] getdents64(4, [pid 298] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1383] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 1383] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./35/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1383] <... futex resumed>) = 0 [pid 298] unlink("./35/bus" [pid 296] getdents64(4, [pid 1383] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] close(4 [pid 298] newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... close resumed>) = 0 [pid 298] unlink("./35/binderfs" [pid 296] rmdir("./36/file1" [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 296] <... rmdir resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 296] getdents64(3, [pid 298] rmdir("./35") = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] mkdir("./36", 0777) = 0 [pid 296] close(3 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] <... close resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1389] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 296] rmdir("./36" [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1394 [pid 1389] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 1389] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1393 attached [pid 1393] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 1393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1393] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1389] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] mkdir("./37", 0777 [pid 1393] <... mount resumed>) = 0 [pid 1389] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 296] <... mkdir resumed>) = 0 [pid 1389] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR./strace-static-x86_64: Process 1394 attached ./strace-static-x86_64: Process 1391 attached ./strace-static-x86_64: Process 1390 attached [pid 1393] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1383] <... futex resumed>) = 0 [pid 1383] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1388] <... futex resumed>) = 0 [pid 1383] <... futex resumed>) = 1 [pid 1388] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1383] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1388] <... open resumed>) = 5 [pid 1388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1383] <... futex resumed>) = 0 [pid 1388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1383] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1383] <... futex resumed>) = 0 [pid 1388] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1383] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1393] <... futex resumed>) = 1 [pid 1393] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1388] <... write resumed>) = 8 [pid 1388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1383] <... futex resumed>) = 0 [pid 1388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1383] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1383] <... futex resumed>) = 0 [pid 1388] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1383] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1388] <... write resumed>) = 1045 [pid 1388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1383] <... futex resumed>) = 0 [pid 1388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1389] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1389] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} => {parent_tid=[1395]}, 88) = 1395 [pid 1389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1389] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1389] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1395 attached [pid 1395] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 1395] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1395] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 1395] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1389] <... futex resumed>) = 0 [pid 1389] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1389] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1395] <... futex resumed>) = 1 [pid 1395] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = -1 ENOENT (No such file or directory) [pid 1395] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1389] <... futex resumed>) = 0 [pid 1389] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 33.634221][ T30] audit: type=1400 audit(1703527023.856:76): avc: denied { remove_name } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [pid 1389] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1395] <... futex resumed>) = 1 [pid 1395] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 EBADF (Bad file descriptor) [pid 1395] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1389] <... futex resumed>) = 0 [pid 1395] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1389] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1395] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1389] <... futex resumed>) = 0 [pid 1395] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1389] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1395] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1395] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1389] <... futex resumed>) = 0 [pid 1395] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1396 [pid 1394] set_robust_list(0x555556d8d6a0, 24 [pid 1391] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1390] set_robust_list(0x7f0c4a20e9a0, 24./strace-static-x86_64: Process 1396 attached [pid 1396] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1396] chdir("./37") = 0 [pid 1396] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1396] setpgid(0, 0) = 0 [pid 1396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1396] write(3, "1000", 4) = 4 [pid 1396] close(3) = 0 [pid 1396] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1396] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1394] <... set_robust_list resumed>) = 0 [pid 1391] <... set_robust_list resumed>) = 0 [pid 1390] <... set_robust_list resumed>) = 0 [pid 1379] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1362] +++ exited with 0 +++ [pid 1355] +++ exited with 0 +++ [pid 1396] <... futex resumed>) = 0 [pid 1394] chdir("./36" [pid 1391] rt_sigprocmask(SIG_SETMASK, [], [pid 1390] rt_sigprocmask(SIG_SETMASK, [], [pid 1387] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1379] ioctl(5, LOOP_CLR_FD [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1355, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1396] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1394] <... chdir resumed>) = 0 [pid 1391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1390] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1387] ioctl(4, LOOP_CLR_FD [pid 1396] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1394] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1391] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1390] memfd_create("syzkaller", 0 [pid 1387] <... ioctl resumed>) = 0 [pid 1396] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1394] <... prctl resumed>) = 0 [pid 1391] <... open resumed>) = 3 [pid 1390] <... memfd_create resumed>) = 4 [pid 1396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1394] setpgid(0, 0 [pid 1391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1390] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1387] close(4 [pid 1396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1394] <... setpgid resumed>) = 0 [pid 1391] <... futex resumed>) = 0 [pid 1390] <... mmap resumed>) = 0x7f0c41dac000 [pid 1387] <... close resumed>) = 0 [pid 294] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1396] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1391] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1390] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1387] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1396] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1394] <... openat resumed>) = 3 [pid 1390] <... write resumed>) = 262144 [pid 1387] <... futex resumed>) = 0 [pid 294] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1396] <... mprotect resumed>) = 0 [pid 1394] write(3, "1000", 4 [pid 1390] munmap(0x7f0c41dac000, 138412032 [pid 1387] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1383] exit_group(0 [pid 1396] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1394] <... write resumed>) = 4 [pid 1390] <... munmap resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 1396] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1394] close(3 [pid 1393] <... futex resumed>) = ? [pid 1390] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1388] <... futex resumed>) = ? [pid 1387] <... futex resumed>) = ? [pid 1383] <... exit_group resumed>) = ? [pid 294] newfstatat(3, "", [pid 1396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1394] <... close resumed>) = 0 [pid 1393] +++ exited with 0 +++ [pid 1390] <... openat resumed>) = 5 [pid 1394] symlink("/dev/binderfs", "./binderfs" [pid 1390] ioctl(5, LOOP_SET_FD, 4 [pid 1388] +++ exited with 0 +++ [pid 1396] <... clone3 resumed> => {parent_tid=[1398]}, 88) = 1398 [pid 1394] <... symlink resumed>) = 0 [pid 1390] <... ioctl resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1396] rt_sigprocmask(SIG_SETMASK, [], [pid 1394] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1394] <... futex resumed>) = 0 [pid 1396] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1394] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] getdents64(3, [pid 1396] <... futex resumed>) = 0 [pid 1394] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1394] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1396] <... futex resumed>) = 0 [pid 1394] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1390] close(4 [pid 1396] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1394] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 294] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1396] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1394] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1390] <... close resumed>) = 0 [pid 1396] <... mprotect resumed>) = 0 [pid 1394] <... mprotect resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1396] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1394] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1390] mkdir("./file1", 0777 [pid 294] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1396] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1394] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1390] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1394] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1390] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 294] newfstatat(AT_FDCWD, "./37/bus", [pid 1396] <... clone3 resumed> => {parent_tid=[1399]}, 88) = 1399 [pid 1394] <... clone3 resumed> => {parent_tid=[1400]}, 88) = 1400 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1396] rt_sigprocmask(SIG_SETMASK, [], [pid 1394] rt_sigprocmask(SIG_SETMASK, [], [pid 294] unlink("./37/bus" [pid 1396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1394] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1396] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1394] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1396] <... futex resumed>) = 0 [pid 1394] <... futex resumed>) = 0 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1394] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1394] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1394] <... mprotect resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./37/binderfs", [pid 1394] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1394] <... rt_sigprocmask resumed>[], 8) = 0 [pid 294] unlink("./37/binderfs" [pid 1394] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 294] <... unlink resumed>) = 0 [pid 1394] <... clone3 resumed> => {parent_tid=[1401]}, 88) = 1401 [pid 294] getdents64(3, [pid 1394] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1394] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] close(3 [pid 1394] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... close resumed>) = 0 [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] rmdir("./37"./strace-static-x86_64: Process 1400 attached [pid 1400] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1400] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... rmdir resumed>) = 0 [pid 294] mkdir("./38", 0777 [pid 1400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1400] memfd_create("syzkaller", 0) = 3 [pid 1400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 294] <... mkdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1400] <... mmap resumed>) = 0x7f0c41dcd000 [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 1400] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 1399 attached [pid 1399] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1399] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1402 [pid 1400] <... write resumed>) = 262144 [pid 1399] <... open resumed>) = 3 [pid 1399] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1396] <... futex resumed>) = 0 [pid 1399] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1396] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1399] <... mount resumed>) = 0 [pid 1396] <... futex resumed>) = 0 [pid 1399] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1399] <... futex resumed>) = 0 [pid 1396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1400] munmap(0x7f0c41dcd000, 138412032 [pid 1399] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1396] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1400] <... munmap resumed>) = 0 [pid 1399] <... open resumed>) = 4 [pid 1396] <... futex resumed>) = 0 [pid 1399] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1400] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1399] <... futex resumed>) = 0 [pid 1396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1400] <... openat resumed>) = 4 [pid 1399] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1396] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1400] ioctl(4, LOOP_SET_FD, 3 [pid 1399] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1396] <... futex resumed>) = 0 [ 33.686946][ T30] audit: type=1400 audit(1703527023.856:77): avc: denied { rename } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.709688][ T1387] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 33.723528][ T1387] EXT4-fs (loop3): get root inode failed [ 33.729031][ T1387] EXT4-fs (loop3): mount failed [ 33.741965][ T1390] loop5: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 1402 attached ./strace-static-x86_64: Process 1401 attached ./strace-static-x86_64: Process 1398 attached [pid 1399] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1402] set_robust_list(0x555556d8d6a0, 24 [pid 1401] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1398] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1402] <... set_robust_list resumed>) = 0 [pid 1401] <... set_robust_list resumed>) = 0 [pid 1398] <... set_robust_list resumed>) = 0 [pid 1402] chdir("./38" [pid 1401] rt_sigprocmask(SIG_SETMASK, [], [pid 1398] rt_sigprocmask(SIG_SETMASK, [], [pid 1402] <... chdir resumed>) = 0 [pid 1401] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1398] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1402] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1401] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1398] memfd_create("syzkaller", 0 [pid 1402] <... prctl resumed>) = 0 [pid 1401] <... open resumed>) = 5 [pid 1400] <... ioctl resumed>) = 0 [pid 1399] <... futex resumed>) = 0 [pid 1398] <... memfd_create resumed>) = 5 [pid 1396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1402] setpgid(0, 0 [pid 1400] close(3 [pid 1399] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1396] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1400] <... close resumed>) = 0 [pid 1399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1396] <... futex resumed>) = 0 [pid 1400] mkdir("./bus", 0777 [pid 1399] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1396] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1400] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1399] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1400] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1399] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1396] <... futex resumed>) = 0 [pid 1399] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1401] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1394] <... futex resumed>) = 0 [pid 1401] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1394] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1394] <... futex resumed>) = 0 [pid 1401] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1401] <... mount resumed>) = 0 [pid 1401] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1394] <... futex resumed>) = 0 [pid 1401] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1394] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1394] <... futex resumed>) = 0 [pid 1401] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1401] <... open resumed>) = 3 [pid 1401] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1394] <... futex resumed>) = 0 [pid 1401] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1394] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1394] <... futex resumed>) = 0 [pid 1401] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1398] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1402] <... setpgid resumed>) = 0 [pid 1401] <... write resumed>) = 8 [pid 1398] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1398] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1398] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1387] +++ exited with 0 +++ [pid 1383] +++ exited with 0 +++ [pid 1398] <... openat resumed>) = 6 [pid 1398] ioctl(6, LOOP_SET_FD, 5 [pid 1402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1401] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1394] <... futex resumed>) = 0 [pid 1402] <... openat resumed>) = 3 [pid 1401] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1394] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1383, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1394] <... futex resumed>) = 0 [pid 1402] write(3, "1000", 4 [pid 1401] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1394] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1402] <... write resumed>) = 4 [pid 297] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] close(3 [pid 1401] <... write resumed>) = 1045 [pid 1402] <... close resumed>) = 0 [pid 1401] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1402] symlink("/dev/binderfs", "./binderfs" [pid 1401] <... futex resumed>) = 1 [pid 1394] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1401] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1402] <... symlink resumed>) = 0 [pid 1402] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 1402] <... futex resumed>) = 0 [pid 1402] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1402] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] <... umount2 resumed>) = 0 [pid 1402] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1402] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 297] newfstatat(AT_FDCWD, "./36/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1402] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] unlink("./36/bus" [pid 1402] <... mprotect resumed>) = 0 [pid 1379] <... ioctl resumed>) = 0 [pid 1379] close(5 [pid 297] <... unlink resumed>) = 0 [pid 1402] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1379] <... close resumed>) = 0 [pid 297] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1379] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1379] <... futex resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./36/binderfs", [pid 1379] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1402] <... clone3 resumed> => {parent_tid=[1406]}, 88) = 1406 [pid 297] unlink("./36/binderfs" [pid 1402] rt_sigprocmask(SIG_SETMASK, [], [pid 1377] exit_group(0 [pid 1380] <... futex resumed>) = ? [pid 1377] <... exit_group resumed>) = ? [pid 297] <... unlink resumed>) = 0 [pid 1398] <... ioctl resumed>) = 0 [pid 1380] +++ exited with 0 +++ [pid 1402] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1379] <... futex resumed>) = ? [pid 1402] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./36/file1", [pid 1402] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1379] +++ exited with 0 +++ [pid 1377] +++ exited with 0 +++ [pid 297] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] <... futex resumed>) = 0 [pid 1398] close(5 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1377, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 1402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1398] <... close resumed>) = 0 [pid 297] openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 1402] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1398] mkdir("./file1", 0777 [pid 297] <... openat resumed>) = 4 [pid 295] <... restart_syscall resumed>) = 0 [pid 1402] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1398] <... mkdir resumed>) = 0 [pid 297] newfstatat(4, "", [pid 1402] <... mprotect resumed>) = 0 [pid 1398] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1402] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] getdents64(4, [pid 295] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1402] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] getdents64(4, [pid 295] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] <... openat resumed>) = 3 [pid 1402] <... clone3 resumed> => {parent_tid=[1407]}, 88) = 1407 [pid 297] close(4 [pid 295] newfstatat(3, "", [pid 1402] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... close resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1402] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 33.762972][ T1400] loop4: detected capacity change from 0 to 512 [ 33.771495][ T1390] EXT4-fs (loop5): 1 orphan inode deleted [ 33.777785][ T1390] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.791843][ T1398] loop2: detected capacity change from 0 to 512 [pid 297] rmdir("./36/file1" [pid 295] getdents64(3, [pid 1402] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... rmdir resumed>) = 0 [pid 1402] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./36") = 0 [pid 297] mkdir("./37", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) ./strace-static-x86_64: Process 1406 attached [pid 297] close(3./strace-static-x86_64: Process 1407 attached [pid 1406] set_robust_list(0x7f0c4a20e9a0, 24 [pid 297] <... close resumed>) = 0 [pid 1407] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1406] <... set_robust_list resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1407] <... set_robust_list resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 1407] rt_sigprocmask(SIG_SETMASK, [], [pid 1406] rt_sigprocmask(SIG_SETMASK, [], [pid 295] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./35/binderfs") = 0 [pid 295] umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./35/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./35/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./35") = 0 [pid 295] mkdir("./36", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1410 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1411 ./strace-static-x86_64: Process 1410 attached [pid 1410] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1410] chdir("./37") = 0 [pid 1410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1410] setpgid(0, 0) = 0 [pid 1410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1410] write(3, "1000", 4) = 4 [pid 1410] close(3) = 0 [pid 1410] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1410] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1410] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1410] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1407] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1407] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1407] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1402] <... futex resumed>) = 0 [pid 1402] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1407] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1407] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1402] <... futex resumed>) = 0 [pid 1402] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1406] memfd_create("syzkaller", 0 [pid 1410] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1406] <... memfd_create resumed>) = 4 [pid 1407] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1410] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1410] <... mprotect resumed>) = 0 [pid 1406] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1407] <... open resumed>) = 5 [pid 1407] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1402] <... futex resumed>) = 0 [pid 1410] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1402] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1410] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1402] <... futex resumed>) = 0 [pid 1410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1407] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1410] <... clone3 resumed> => {parent_tid=[1413]}, 88) = 1413 [pid 1407] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1407] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1402] <... futex resumed>) = 0 [pid 1410] rt_sigprocmask(SIG_SETMASK, [], [pid 1407] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1406] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1402] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1407] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1402] <... futex resumed>) = 0 [pid 1407] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1402] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1407] <... futex resumed>) = 0 [pid 1402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1407] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1410] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1411 attached [pid 1390] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1410] <... futex resumed>) = 0 [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1390] ioctl(5, LOOP_CLR_FD [pid 1406] <... write resumed>) = 262144 [pid 1411] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1411] chdir("./36") = 0 [pid 1411] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1411] setpgid(0, 0) = 0 [ 33.818624][ T1390] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/39/file1 supports timestamps until 2038 (0x7fffffff) [ 33.841214][ T1400] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1411] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1411] write(3, "1000", 4) = 4 [pid 1411] close(3) = 0 [pid 1411] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1411] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1411] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1411] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1411] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1411] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1411] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1414]}, 88) = 1414 [pid 1411] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1411] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 1413 attached [pid 1410] <... futex resumed>) = 0 [pid 1406] munmap(0x7f0c41dcd000, 138412032 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1411] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1411] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1411] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1415]}, 88) = 1415 [pid 1411] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1411] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1415 attached [pid 1415] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1415] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1411] <... futex resumed>) = 0 [pid 1411] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1415] <... futex resumed>) = 1 [pid 1415] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1411] <... futex resumed>) = 0 [pid 1411] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1415] <... futex resumed>) = 1 [pid 1415] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 1415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1411] <... futex resumed>) = 0 [pid 1411] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1415] <... futex resumed>) = 1 [pid 1415] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 1415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1411] <... futex resumed>) = 0 [pid 1411] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1411] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1415] <... futex resumed>) = 1 [pid 1415] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 1413] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1406] <... munmap resumed>) = 0 [pid 1415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1413] <... set_robust_list resumed>) = 0 [pid 1410] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1406] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1413] rt_sigprocmask(SIG_SETMASK, [], [pid 1410] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1406] <... openat resumed>) = 6 [pid 1413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1410] <... mprotect resumed>) = 0 [pid 1406] ioctl(6, LOOP_SET_FD, 4 [pid 1415] <... futex resumed>) = 1 [pid 1411] <... futex resumed>) = 0 [pid 1413] memfd_create("syzkaller", 0 [pid 1410] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1413] <... memfd_create resumed>) = 3 [pid 1410] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1413] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1410] <... clone3 resumed> => {parent_tid=[1416]}, 88) = 1416 ./strace-static-x86_64: Process 1414 attached [pid 1413] <... write resumed>) = 262144 [pid 1410] rt_sigprocmask(SIG_SETMASK, [], [pid 1414] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1413] munmap(0x7f0c41dcd000, 138412032 [pid 1410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1414] <... set_robust_list resumed>) = 0 [pid 1413] <... munmap resumed>) = 0 [pid 1410] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1414] rt_sigprocmask(SIG_SETMASK, [], [pid 1413] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1410] <... futex resumed>) = 0 [pid 1415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1414] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1413] <... openat resumed>) = 4 [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1414] memfd_create("syzkaller", 0 [ 33.870364][ T1398] EXT4-fs (loop2): 1 orphan inode deleted [ 33.876396][ T1398] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.890471][ T1406] loop0: detected capacity change from 0 to 512 [ 33.890515][ T1398] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/37/file1 supports timestamps until 2038 (0x7fffffff) [ 33.902479][ T1400] EXT4-fs (loop4): get root inode failed [pid 1413] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1416 attached [pid 1414] <... memfd_create resumed>) = 5 [pid 1406] <... ioctl resumed>) = 0 [pid 1398] <... mount resumed>) = 0 [pid 1390] <... ioctl resumed>) = 0 [pid 1416] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1414] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1413] <... ioctl resumed>) = 0 [pid 1406] close(4 [pid 1400] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1398] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1390] close(5 [pid 1416] <... set_robust_list resumed>) = 0 [pid 1414] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1413] close(3 [pid 1406] <... close resumed>) = 0 [pid 1398] <... openat resumed>) = 5 [pid 1416] rt_sigprocmask(SIG_SETMASK, [], [pid 1406] mkdir("./file1", 0777 [pid 1400] ioctl(4, LOOP_CLR_FD [pid 1398] chdir("./file1" [pid 1390] <... close resumed>) = 0 [pid 1416] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1414] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1406] <... mkdir resumed>) = 0 [pid 1400] <... ioctl resumed>) = 0 [pid 1398] <... chdir resumed>) = 0 [pid 1390] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1416] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1406] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1400] close(4 [pid 1398] ioctl(6, LOOP_CLR_FD [pid 1390] <... futex resumed>) = 0 [pid 1416] <... open resumed>) = 5 [pid 1414] <... write resumed>) = 262144 [pid 1400] <... close resumed>) = 0 [pid 1398] <... ioctl resumed>) = 0 [pid 1390] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1414] munmap(0x7f0c41dcd000, 138412032 [pid 1400] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1398] close(6 [pid 1394] exit_group(0 [pid 1389] exit_group(0 [pid 1416] <... futex resumed>) = 1 [pid 1414] <... munmap resumed>) = 0 [pid 1413] <... close resumed>) = 0 [pid 1410] <... futex resumed>) = 0 [pid 1401] <... futex resumed>) = ? [pid 1400] <... futex resumed>) = ? [pid 1398] <... close resumed>) = 0 [pid 1395] <... futex resumed>) = ? [pid 1394] <... exit_group resumed>) = ? [pid 1391] <... futex resumed>) = ? [pid 1390] <... futex resumed>) = ? [pid 1389] <... exit_group resumed>) = ? [pid 1416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1414] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1410] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1401] +++ exited with 0 +++ [pid 1398] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1395] +++ exited with 0 +++ [pid 1391] +++ exited with 0 +++ [pid 1390] +++ exited with 0 +++ [pid 1396] exit_group(0 [pid 1416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1414] <... openat resumed>) = 6 [pid 1410] <... futex resumed>) = 0 [pid 1399] <... futex resumed>) = ? [pid 1398] <... futex resumed>) = ? [pid 1396] <... exit_group resumed>) = ? [pid 1389] +++ exited with 0 +++ [pid 1416] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1414] ioctl(6, LOOP_SET_FD, 5 [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1399] +++ exited with 0 +++ [pid 1398] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1389, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 1416] <... mount resumed>) = 0 [pid 1396] +++ exited with 0 +++ [ 33.914816][ T1413] loop3: detected capacity change from 0 to 512 [ 33.915868][ T1400] EXT4-fs (loop4): mount failed [pid 1416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 1410] <... futex resumed>) = 0 [pid 1410] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... restart_syscall resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1396, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 1416] <... futex resumed>) = 0 [pid 1410] <... futex resumed>) = 1 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 1416] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1416] <... open resumed>) = 3 [pid 299] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1416] <... futex resumed>) = 1 [pid 1410] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1410] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1410] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] <... restart_syscall resumed>) = 0 [pid 1416] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] newfstatat(3, "", [pid 296] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] getdents64(3, [pid 296] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1416] <... write resumed>) = 8 [pid 1416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 296] <... openat resumed>) = 3 [pid 1416] <... futex resumed>) = 1 [pid 1410] <... futex resumed>) = 0 [pid 299] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(3, "", [pid 1416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1410] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1410] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./39/binderfs", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1416] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1410] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1416] <... write resumed>) = 1045 [pid 299] unlink("./39/binderfs" [pid 296] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 1416] <... futex resumed>) = 1 [pid 1410] <... futex resumed>) = 0 [pid 299] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 1416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./39/file1", [pid 296] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1400] +++ exited with 0 +++ [pid 1394] +++ exited with 0 +++ [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1413] mkdir("./bus", 0777 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./39/file1" [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1394, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] newfstatat(AT_FDCWD, "./37/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] unlink("./37/bus" [pid 1413] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1414] <... ioctl resumed>) = 0 [pid 299] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1413] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1414] close(5) = 0 [pid 1414] mkdir("./file1", 0777 [pid 299] close(3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1414] <... mkdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 33.944028][ T1414] loop1: detected capacity change from 0 to 512 [ 33.958419][ T1406] EXT4-fs (loop0): 1 orphan inode deleted [ 33.965205][ T1406] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.965676][ T1413] EXT4-fs (loop3): Invalid log block size: 2475723007 [ 33.977170][ T1406] ext4 filesystem being mounted at /root/syzkaller.iF59aB/38/file1 supports timestamps until 2038 (0x7fffffff) [pid 1414] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] rmdir("./39" [pid 298] <... openat resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./37/binderfs", [pid 1413] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1406] <... mount resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] mkdir("./40", 0777 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] unlink("./37/binderfs" [pid 299] <... mkdir resumed>) = 0 [pid 298] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 3 [pid 298] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1413] ioctl(4, LOOP_CLR_FD [pid 1406] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 298] newfstatat(AT_FDCWD, "./36/bus", [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./36/bus"./strace-static-x86_64: Process 1419 attached [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1419 [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./36/binderfs" [pid 1419] set_robust_list(0x555556d8d6a0, 24 [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./36" [pid 1419] <... set_robust_list resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./37", 0777 [pid 1419] chdir("./40" [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1419] <... chdir resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1421 [pid 1419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1419] setpgid(0, 0) = 0 [pid 1419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1419] write(3, "1000", 4) = 4 [pid 1419] close(3) = 0 [pid 1419] symlink("/dev/binderfs", "./binderfs" [pid 1413] <... ioctl resumed>) = 0 [pid 1406] <... openat resumed>) = 4 [pid 1413] close(4 [pid 1406] chdir("./file1" [pid 1419] <... symlink resumed>) = 0 [pid 1419] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1413] <... close resumed>) = 0 [pid 1406] <... chdir resumed>) = 0 [pid 1413] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1406] ioctl(6, LOOP_CLR_FD [pid 1413] <... futex resumed>) = 0 [pid 1410] exit_group(0 [pid 1406] <... ioctl resumed>) = 0 [pid 1416] <... futex resumed>) = ? [pid 1410] <... exit_group resumed>) = ? [pid 1406] close(6 [pid 1416] +++ exited with 0 +++ [pid 1413] +++ exited with 0 +++ [pid 1406] <... close resumed>) = 0 [pid 1406] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1402] exit_group(0 [pid 1406] <... futex resumed>) = ? [pid 1407] <... futex resumed>) = 231 [pid 1402] <... exit_group resumed>) = ? [pid 1407] +++ exited with 0 +++ [pid 1419] <... futex resumed>) = 0 [pid 1419] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1406] +++ exited with 0 +++ [pid 1402] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1402, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1419] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1419] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 ./strace-static-x86_64: Process 1421 attached [pid 1419] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] newfstatat(3, "", [pid 1421] set_robust_list(0x555556d8d6a0, 24 [pid 1419] <... mprotect resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, [pid 1421] <... set_robust_list resumed>) = 0 [pid 1419] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 294] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./38/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./38/bus") = 0 [pid 294] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./38/binderfs") = 0 [pid 294] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1421] chdir("./37") = 0 [pid 1421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1421] setpgid(0, 0) = 0 [pid 1421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1421] write(3, "1000", 4) = 4 [pid 1421] close(3) = 0 [pid 1421] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1421] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1421] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1421] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1421] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1423]}, 88) = 1423 [pid 1421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1421] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1421] <... futex resumed>) = 0 [pid 1421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1421] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1421] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1424]}, 88) = 1424 [pid 1421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1421] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1423 attached [pid 1423] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1423] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1423] memfd_create("syzkaller", 0) = 3 [pid 1423] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1423] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1423] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1423] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 1423] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 1425 attached ./strace-static-x86_64: Process 1424 attached [pid 1410] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1410, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1423] <... ioctl resumed>) = 0 [pid 1423] close(3) = 0 [pid 1423] mkdir("./file1", 0777) = 0 [pid 1423] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1425] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1425] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1424] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1424] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1424] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1421] <... futex resumed>) = 0 [pid 1424] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1421] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1424] <... mount resumed>) = 0 [pid 1421] <... futex resumed>) = 0 [pid 1424] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1419] <... clone3 resumed> => {parent_tid=[1425]}, 88) = 1425 [pid 297] <... umount2 resumed>) = 0 [pid 296] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1424] <... futex resumed>) = 0 [pid 1421] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1419] rt_sigprocmask(SIG_SETMASK, [], [pid 297] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] newfstatat(AT_FDCWD, "./37/file1", [pid 1419] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1425] <... futex resumed>) = 0 [pid 1419] <... futex resumed>) = 1 [pid 296] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1425] memfd_create("syzkaller", 0 [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1425] <... memfd_create resumed>) = 3 [pid 1419] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1425] <... mmap resumed>) = 0x7f0c41dee000 [pid 296] <... openat resumed>) = 4 [pid 1419] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1424] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1421] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1424] <... open resumed>) = 5 [pid 1421] <... futex resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./37/bus", [pid 1424] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1424] <... futex resumed>) = 0 [pid 1421] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] unlink("./37/bus" [pid 1425] <... write resumed>) = 262144 [pid 1424] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1421] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 1414] <... mount resumed>) = 0 [pid 296] newfstatat(4, "", [pid 294] <... umount2 resumed>) = 0 [pid 1425] munmap(0x7f0c41dee000, 138412032 [pid 1419] <... mprotect resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1425] <... munmap resumed>) = 0 [pid 1419] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] getdents64(4, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1425] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1419] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] newfstatat(AT_FDCWD, "./38/file1", [pid 1425] <... openat resumed>) = 4 [pid 1419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 296] getdents64(4, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1425] ioctl(4, LOOP_SET_FD, 3 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1426 attached [pid 1424] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1421] <... futex resumed>) = 0 [pid 1414] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [ 34.027745][ T1414] EXT4-fs (loop1): 1 orphan inode deleted [ 34.035986][ T1414] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.047703][ T1423] loop4: detected capacity change from 0 to 512 [ 34.053082][ T1414] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/36/file1 supports timestamps until 2038 (0x7fffffff) [pid 297] <... unlink resumed>) = 0 [pid 1424] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1414] <... openat resumed>) = 5 [pid 297] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1414] chdir("./file1" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1414] <... chdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./37/binderfs", [pid 1414] ioctl(6, LOOP_CLR_FD [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1414] <... ioctl resumed>) = 0 [pid 297] unlink("./37/binderfs" [pid 1414] close(6 [pid 297] <... unlink resumed>) = 0 [pid 1426] set_robust_list(0x7f0c41ded9a0, 24 [pid 1425] <... ioctl resumed>) = 0 [pid 1424] <... write resumed>) = 8 [pid 1419] <... clone3 resumed> => {parent_tid=[1426]}, 88) = 1426 [pid 296] close(4 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1426] <... set_robust_list resumed>) = 0 [pid 1425] close(3 [pid 1424] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] rt_sigprocmask(SIG_SETMASK, [], [pid 1414] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "./38/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1426] rt_sigprocmask(SIG_SETMASK, [], [pid 1425] <... close resumed>) = 0 [pid 1424] <... futex resumed>) = 1 [pid 1421] <... futex resumed>) = 0 [pid 1419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1414] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./37/file1" [pid 294] <... openat resumed>) = 4 [pid 1426] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1425] mkdir("./bus", 0777 [pid 1424] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1421] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1414] <... futex resumed>) = 0 [pid 297] close(3 [pid 296] <... rmdir resumed>) = 0 [pid 294] newfstatat(4, "", [pid 1426] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1425] <... mkdir resumed>) = 0 [pid 1424] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1414] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1411] exit_group(0 [pid 1421] <... futex resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 1419] <... futex resumed>) = 0 [pid 1414] <... futex resumed>) = ? [pid 1411] <... exit_group resumed>) = ? [pid 297] rmdir("./37" [pid 296] getdents64(3, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1414] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./38", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 1426] <... open resumed>) = -1 EISDIR (Is a directory) [pid 1424] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1421] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1415] <... futex resumed>) = ? [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] getdents64(4, [pid 1425] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1429 [pid 1426] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1426] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1426] <... futex resumed>) = 0 [pid 1419] <... futex resumed>) = 1 [pid 1426] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1429 attached [pid 1426] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1424] <... write resumed>) = 1045 [pid 1423] <... mount resumed>) = 0 [pid 1415] +++ exited with 0 +++ [pid 1411] +++ exited with 0 +++ [pid 296] close(3 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1424] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 294] getdents64(4, [pid 1429] set_robust_list(0x555556d8d6a0, 24 [pid 1426] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1424] <... futex resumed>) = 1 [pid 1421] <... futex resumed>) = 0 [pid 296] rmdir("./37" [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1411, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1429] <... set_robust_list resumed>) = 0 [pid 1426] <... futex resumed>) = 1 [pid 1424] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1423] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1419] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 294] close(4 [pid 1429] chdir("./38" [pid 1426] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] mkdir("./38", 0777 [pid 294] <... close resumed>) = 0 [pid 1429] <... chdir resumed>) = 0 [pid 1426] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1423] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 1429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1426] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1423] ioctl(4, LOOP_CLR_FD [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] rmdir("./38/file1" [pid 1429] <... prctl resumed>) = 0 [pid 1426] <... open resumed>) = -1 EISDIR (Is a directory) [pid 1423] <... ioctl resumed>) = 0 [pid 1419] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1429] setpgid(0, 0 [pid 1426] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 34.072909][ T1425] loop5: detected capacity change from 0 to 512 [ 34.094194][ T1423] EXT4-fs (loop4): 1 orphan inode deleted [ 34.102983][ T1423] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.114480][ T1423] ext4 filesystem being mounted at /root/syzkaller.qPQybd/37/file1 supports timestamps until 2038 (0x7fffffff) [pid 1423] close(4 [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... rmdir resumed>) = 0 [pid 1429] <... setpgid resumed>) = 0 [pid 1426] <... futex resumed>) = 0 [pid 1423] <... close resumed>) = 0 [pid 1419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1426] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1423] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 1429] <... openat resumed>) = 3 [pid 1421] exit_group(0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] getdents64(3, [pid 1424] <... futex resumed>) = ? [pid 1421] <... exit_group resumed>) = ? [pid 296] close(3 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1424] +++ exited with 0 +++ [pid 296] <... close resumed>) = 0 [pid 294] close(3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... close resumed>) = 0 [pid 294] rmdir("./38" [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1432 [pid 294] <... rmdir resumed>) = 0 [pid 294] mkdir("./39", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1433 ./strace-static-x86_64: Process 1433 attached [pid 1433] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1433] chdir("./39") = 0 [pid 1433] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1433] setpgid(0, 0) = 0 [pid 1433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 1432 attached [pid 1433] write(3, "1000", 4 [pid 1432] set_robust_list(0x555556d8d6a0, 24 [pid 1433] <... write resumed>) = 4 [pid 1433] close(3) = 0 [pid 1432] <... set_robust_list resumed>) = 0 [pid 1433] symlink("/dev/binderfs", "./binderfs" [pid 1432] chdir("./38" [pid 1433] <... symlink resumed>) = 0 [pid 1432] <... chdir resumed>) = 0 [pid 1432] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1432] setpgid(0, 0 [pid 1433] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1432] <... setpgid resumed>) = 0 [pid 1432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1433] <... futex resumed>) = 0 [pid 1433] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1433] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1432] <... openat resumed>) = 3 [pid 1433] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1433] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1433] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1432] write(3, "1000", 4) = 4 [pid 1432] close(3) = 0 [pid 1432] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1433] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1433] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1432] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1433] <... clone3 resumed> => {parent_tid=[1434]}, 88) = 1434 [pid 1433] rt_sigprocmask(SIG_SETMASK, [], [pid 1432] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1432] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1433] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1432] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1433] <... futex resumed>) = 0 [pid 1432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1433] <... futex resumed>) = 0 [pid 1432] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1432] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1433] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1432] <... mprotect resumed>) = 0 [pid 1433] <... mprotect resumed>) = 0 [pid 1432] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1433] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1429] write(3, "1000", 4 [pid 1426] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1419] <... futex resumed>) = 0 [pid 295] newfstatat(3, "", [pid 1429] <... write resumed>) = 4 [pid 1426] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1423] <... futex resumed>) = ? [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1433] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1433] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1432] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1432] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1433] <... clone3 resumed> => {parent_tid=[1435]}, 88) = 1435 [pid 1423] +++ exited with 0 +++ [pid 1421] +++ exited with 0 +++ [pid 1426] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 1433] rt_sigprocmask(SIG_SETMASK, [], [pid 1432] <... clone3 resumed> => {parent_tid=[1436]}, 88) = 1436 [pid 1429] close(3 [pid 295] getdents64(3, [pid 1433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1432] rt_sigprocmask(SIG_SETMASK, [], [pid 1433] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1429] <... close resumed>) = 0 [pid 1426] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1421, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1433] <... futex resumed>) = 0 [pid 1432] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1429] symlink("/dev/binderfs", "./binderfs" [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1432] <... futex resumed>) = 0 [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1429] <... symlink resumed>) = 0 [pid 1426] <... futex resumed>) = 1 [pid 1419] <... futex resumed>) = 0 [pid 295] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1432] <... futex resumed>) = 0 [pid 1432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1432] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1426] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1419] <... futex resumed>) = 0 [pid 1432] <... mprotect resumed>) = 0 [pid 1429] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1426] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 298] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 1432] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1429] <... futex resumed>) = 0 [pid 1426] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 1436 attached [pid 1432] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1429] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1426] <... futex resumed>) = 0 [pid 1419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1435 attached [pid 1436] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1432] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1429] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1426] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... openat resumed>) = 3 [pid 295] newfstatat(AT_FDCWD, "./36/bus", [pid 1436] <... set_robust_list resumed>) = 0 [pid 1435] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1436] rt_sigprocmask(SIG_SETMASK, [], [pid 1435] <... set_robust_list resumed>) = 0 [pid 1432] <... clone3 resumed> => {parent_tid=[1437]}, 88) = 1437 [pid 1436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1435] rt_sigprocmask(SIG_SETMASK, [], [pid 1432] rt_sigprocmask(SIG_SETMASK, [], [pid 1436] memfd_create("syzkaller", 0 [pid 1435] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1436] <... memfd_create resumed>) = 3 [pid 1435] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1432] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1436] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1435] <... open resumed>) = 3 [pid 1432] <... futex resumed>) = 0 [pid 1436] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1435] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1436] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1435] <... futex resumed>) = 1 [pid 1433] <... futex resumed>) = 0 [pid 1436] <... write resumed>) = 262144 [pid 1435] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1433] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1434 attached [pid 1435] <... mount resumed>) = 0 [pid 1433] <... futex resumed>) = 0 [pid 1435] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1434] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1435] <... futex resumed>) = 0 [pid 1434] <... set_robust_list resumed>) = 0 [pid 1433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1435] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1434] rt_sigprocmask(SIG_SETMASK, [], [pid 1433] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1435] <... open resumed>) = 4 [pid 1434] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1433] <... futex resumed>) = 0 [pid 1435] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1434] memfd_create("syzkaller", 0 [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1435] <... futex resumed>) = 0 [pid 1434] <... memfd_create resumed>) = 5 [pid 1433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1435] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1433] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1436] munmap(0x7f0c41dcd000, 138412032 [pid 1435] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1434] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1433] <... futex resumed>) = 0 [pid 1429] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1425] <... mount resumed>) = 0 [pid 298] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 1437 attached [pid 1435] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1425] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] unlink("./36/bus" [pid 1437] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1436] <... munmap resumed>) = 0 [pid 1435] <... futex resumed>) = 0 [pid 1433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1425] <... openat resumed>) = 3 [pid 298] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 1436] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1435] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1433] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1436] <... openat resumed>) = 4 [pid 1435] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1433] <... futex resumed>) = 0 [pid 1436] ioctl(4, LOOP_SET_FD, 3 [pid 1435] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1433] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1437] <... set_robust_list resumed>) = 0 [pid 1435] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1434] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1429] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1425] chdir("./bus" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1437] rt_sigprocmask(SIG_SETMASK, [], [pid 1434] <... write resumed>) = 262144 [pid 1429] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1425] <... chdir resumed>) = 0 [pid 298] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1437] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1429] <... mprotect resumed>) = 0 [ 34.133730][ T1425] EXT4-fs (loop5): 1 orphan inode deleted [ 34.139408][ T1425] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.163083][ T1425] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/40/bus supports timestamps until 2038 (0x7fffffff) [pid 1425] ioctl(4, LOOP_CLR_FD [pid 295] newfstatat(AT_FDCWD, "./36/binderfs", [pid 1437] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1434] munmap(0x7f0c41dcd000, 138412032 [pid 1429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1425] <... ioctl resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1437] <... open resumed>) = 5 [pid 1434] <... munmap resumed>) = 0 [pid 1429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1425] close(4 [pid 295] unlink("./36/binderfs" [pid 1437] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1436] <... ioctl resumed>) = 0 [pid 1435] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 1429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1436] close(3 [pid 1435] <... futex resumed>) = 1 [pid 1433] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 1436] <... close resumed>) = 0 [pid 1435] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1436] mkdir("./bus", 0777 [pid 1429] <... clone3 resumed> => {parent_tid=[1438]}, 88) = 1438 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1436] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1429] rt_sigprocmask(SIG_SETMASK, [], [pid 1436] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1438 attached [pid 1438] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1438] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 1434] ioctl(6, LOOP_SET_FD, 5 [pid 298] newfstatat(AT_FDCWD, "./37/bus", [pid 1429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1437] <... futex resumed>) = 1 [pid 1429] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1425] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1437] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1432] <... futex resumed>) = 0 [pid 1429] <... futex resumed>) = 1 [pid 1425] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./37/bus" [pid 1438] <... futex resumed>) = 0 [pid 1432] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1425] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 1429] <... futex resumed>) = 0 [pid 1425] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1419] exit_group(0 [pid 298] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1426] <... futex resumed>) = ? [pid 1425] <... futex resumed>) = ? [pid 1419] <... exit_group resumed>) = ? [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1429] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1426] +++ exited with 0 +++ [pid 1425] +++ exited with 0 +++ [pid 1419] +++ exited with 0 +++ [pid 298] newfstatat(AT_FDCWD, "./37/binderfs", [pid 1429] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1419, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1429] <... mprotect resumed>) = 0 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 298] unlink("./37/binderfs" [pid 1429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... restart_syscall resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 1429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1429] <... clone3 resumed> => {parent_tid=[1439]}, 88) = 1439 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1429] rt_sigprocmask(SIG_SETMASK, [], [pid 299] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 1429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 1429] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 1432] <... futex resumed>) = 1 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1434] <... ioctl resumed>) = 0 [pid 1434] close(5) = 0 [pid 1434] mkdir("./file1", 0777) = 0 [pid 1434] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1438] memfd_create("syzkaller", 0) = 3 [pid 1438] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./40/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./40/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", [pid 1437] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1437] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, [pid 1437] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1432] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1437] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1432] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1437] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1432] <... futex resumed>) = 0 [pid 299] close(4 [pid 1437] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1437] <... open resumed>) = 3 [pid 299] <... close resumed>) = 0 [pid 1437] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./40/bus" [pid 1437] <... futex resumed>) = 1 [pid 1432] <... futex resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 1437] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1432] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1437] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1432] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1437] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1437] <... write resumed>) = 8 [pid 1437] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1432] <... futex resumed>) = 0 [pid 299] unlink("./40/binderfs" [pid 1437] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1432] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1437] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 1439 attached [pid 1437] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1432] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 1432] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1439] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1437] <... write resumed>) = 1045 [pid 299] close(3 [pid 1439] <... set_robust_list resumed>) = 0 [pid 1437] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 1439] rt_sigprocmask(SIG_SETMASK, [], [pid 1437] <... futex resumed>) = 1 [pid 1432] <... futex resumed>) = 0 [pid 1439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1437] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1439] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 299] rmdir("./40" [pid 1439] <... open resumed>) = 4 [pid 299] <... rmdir resumed>) = 0 [pid 1439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] mkdir("./41", 0777 [pid 1439] <... futex resumed>) = 1 [pid 1438] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1429] <... futex resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 1429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1429] <... futex resumed>) = 0 [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1439] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1429] <... futex resumed>) = 0 [pid 1439] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1439] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1429] <... futex resumed>) = 0 [pid 1439] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1439] <... open resumed>) = 5 [pid 1439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1429] <... futex resumed>) = 0 [pid 1439] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1439] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1429] <... futex resumed>) = 0 [pid 1439] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1439] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1429] <... futex resumed>) = 0 [pid 1439] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1439] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1429] <... futex resumed>) = 0 [pid 1439] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1439] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1429] <... futex resumed>) = 0 [pid 1439] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1438] <... write resumed>) = 262144 [pid 1438] munmap(0x7f0c41dcd000, 138412032) = 0 [ 34.179829][ T1436] loop2: detected capacity change from 0 to 512 [ 34.192989][ T1434] loop0: detected capacity change from 0 to 512 [ 34.216776][ T1436] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1438] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 1438] ioctl(6, LOOP_SET_FD, 3) = 0 [pid 1438] close(3) = 0 [pid 1438] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1438] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./37/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] newfstatat(4, "", [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] close(3 [pid 298] getdents64(4, [pid 299] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1444 [pid 298] close(4) = 0 [pid 298] rmdir("./37/file1") = 0 [pid 298] getdents64(3, [pid 1436] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1436] ioctl(4, LOOP_CLR_FD [pid 298] close(3 [pid 1436] <... ioctl resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 1436] close(4 [pid 298] rmdir("./37" [pid 1436] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 1436] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./38", 0777 [pid 1436] <... futex resumed>) = 0 [pid 1432] exit_group(0 [pid 298] <... mkdir resumed>) = 0 [pid 1432] <... exit_group resumed>) = ? [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1436] +++ exited with 0 +++ [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 1446 ./strace-static-x86_64: Process 1446 attached [pid 1437] <... futex resumed>) = ? [pid 1446] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1446] chdir("./38" [pid 1437] +++ exited with 0 +++ [pid 1432] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1432, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1446] <... chdir resumed>) = 0 [pid 1446] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1446] setpgid(0, 0) = 0 [pid 296] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1446] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] newfstatat(AT_FDCWD, "./36/file1", [pid 1446] write(3, "1000", 4 [pid 296] <... openat resumed>) = 3 [pid 1446] <... write resumed>) = 4 [pid 296] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1446] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1446] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1446] symlink("/dev/binderfs", "./binderfs" [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1446] <... symlink resumed>) = 0 [pid 296] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1446] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... openat resumed>) = 4 [pid 1446] <... futex resumed>) = 0 [pid 296] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(4, "", [pid 1446] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1446] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] newfstatat(AT_FDCWD, "./38/bus", [pid 295] getdents64(4, [pid 1446] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./38/bus" [pid 295] getdents64(4, [pid 1446] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 1446] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(4 [pid 1446] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... close resumed>) = 0 [pid 1446] <... mprotect resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./38/binderfs", [pid 295] rmdir("./36/file1" [pid 1446] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1446] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] unlink("./38/binderfs" [pid 295] <... rmdir resumed>) = 0 [pid 1446] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] <... unlink resumed>) = 0 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 1446] <... clone3 resumed> => {parent_tid=[1447]}, 88) = 1447 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1446] rt_sigprocmask(SIG_SETMASK, [], [pid 296] close(3 [pid 295] close(3 [pid 1446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... close resumed>) = 0 [pid 1446] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./38" [pid 295] <... close resumed>) = 0 [pid 1446] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] rmdir("./36"./strace-static-x86_64: Process 1444 attached [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] mkdir("./39", 0777 [pid 1446] <... futex resumed>) = 0 [pid 1444] set_robust_list(0x555556d8d6a0, 24 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 1446] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] mkdir("./37", 0777 [pid 1446] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1444] <... set_robust_list resumed>) = 0 [pid 1446] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1446] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1446] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] <... mkdir resumed>) = 0 [pid 1446] <... clone3 resumed> => {parent_tid=[1448]}, 88) = 1448 [pid 1446] rt_sigprocmask(SIG_SETMASK, [], [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1446] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 34.224195][ T1438] loop3: detected capacity change from 0 to 512 [ 34.230973][ T1436] EXT4-fs (loop2): get root inode failed [ 34.242169][ T1436] EXT4-fs (loop2): mount failed [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1447 attached [pid 1447] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1447] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1447] memfd_create("syzkaller", 0) = 3 [pid 1447] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1447] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 1448 attached [pid 1448] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 1448] rt_sigprocmask(SIG_SETMASK, [], [pid 296] ioctl(3, LOOP_CLR_FD [pid 1448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1448] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 296] close(3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 1448] <... open resumed>) = 4 [pid 1447] <... write resumed>) = 262144 [pid 296] <... close resumed>) = 0 [pid 1448] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1448] <... futex resumed>) = 1 [pid 1447] munmap(0x7f0c41dcd000, 138412032 [pid 1446] <... futex resumed>) = 0 [pid 1448] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1447] <... munmap resumed>) = 0 [pid 1446] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1449 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1448] <... mount resumed>) = 0 [pid 1447] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1446] <... futex resumed>) = 0 [pid 295] close(3 [pid 1448] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1447] <... openat resumed>) = 5 [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1448] <... futex resumed>) = 0 [pid 1447] ioctl(5, LOOP_SET_FD, 3 [pid 1446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... close resumed>) = 0 [pid 1448] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1446] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1444] chdir("./41" [pid 1446] <... futex resumed>) = 0 [pid 1444] <... chdir resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1444] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1450 [pid 1444] <... prctl resumed>) = 0 [pid 1444] setpgid(0, 0) = 0 [pid 1444] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1444] write(3, "1000", 4) = 4 [pid 1444] close(3) = 0 [pid 1444] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 1449 attached ) = 0 ./strace-static-x86_64: Process 1450 attached [pid 1449] set_robust_list(0x555556d8d6a0, 24 [pid 1444] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1450] set_robust_list(0x555556d8d6a0, 24 [pid 1449] <... set_robust_list resumed>) = 0 [pid 1444] <... futex resumed>) = 0 [pid 1450] <... set_robust_list resumed>) = 0 [pid 1449] chdir("./39" [pid 1444] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1450] chdir("./37" [pid 1449] <... chdir resumed>) = 0 [pid 1444] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1450] <... chdir resumed>) = 0 [pid 1449] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1444] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1450] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1449] <... prctl resumed>) = 0 [pid 1444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1450] <... prctl resumed>) = 0 [pid 1449] setpgid(0, 0 [pid 1444] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1450] setpgid(0, 0 [pid 1449] <... setpgid resumed>) = 0 [pid 1444] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1450] <... setpgid resumed>) = 0 [pid 1449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1444] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1449] <... openat resumed>) = 3 [pid 1444] <... mprotect resumed>) = 0 [pid 1450] <... openat resumed>) = 3 [pid 1449] write(3, "1000", 4 [pid 1444] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1450] write(3, "1000", 4 [pid 1449] <... write resumed>) = 4 [pid 1444] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1450] <... write resumed>) = 4 [pid 1449] close(3 [pid 1444] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1450] close(3 [pid 1449] <... close resumed>) = 0 [pid 1450] <... close resumed>) = 0 [pid 1449] symlink("/dev/binderfs", "./binderfs" [pid 1444] <... clone3 resumed> => {parent_tid=[1452]}, 88) = 1452 [pid 1450] symlink("/dev/binderfs", "./binderfs" [pid 1449] <... symlink resumed>) = 0 [pid 1444] rt_sigprocmask(SIG_SETMASK, [], [pid 1450] <... symlink resumed>) = 0 [pid 1449] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1450] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... futex resumed>) = 0 [pid 1444] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1450] <... futex resumed>) = 0 [pid 1449] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1444] <... futex resumed>) = 0 [pid 1450] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1449] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1450] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1449] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1447] <... ioctl resumed>) = 0 [pid 1444] <... futex resumed>) = 0 [pid 1450] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1449] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1447] close(3 [pid 1444] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1450] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1449] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1447] <... close resumed>) = 0 [pid 1444] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1450] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1449] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1447] mkdir("./bus", 0777 [pid 1444] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1450] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1449] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1447] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1444] <... mprotect resumed>) = 0 [pid 1450] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1449] <... mprotect resumed>) = 0 [pid 1447] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1444] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1450] <... mprotect resumed>) = 0 [pid 1449] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1444] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1450] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1449] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1444] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1450] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1449] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1450] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1444] <... clone3 resumed> => {parent_tid=[1453]}, 88) = 1453 [pid 1449] <... clone3 resumed> => {parent_tid=[1454]}, 88) = 1454 [pid 1448] <... open resumed>) = 6 [pid 1444] rt_sigprocmask(SIG_SETMASK, [], [pid 1450] <... clone3 resumed> => {parent_tid=[1455]}, 88) = 1455 [pid 1449] rt_sigprocmask(SIG_SETMASK, [], [pid 1448] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1450] rt_sigprocmask(SIG_SETMASK, [], [pid 1449] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1448] <... futex resumed>) = 1 [pid 1446] <... futex resumed>) = 0 [pid 1444] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1450] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1449] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1448] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1446] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1444] <... futex resumed>) = 0 [pid 1450] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... futex resumed>) = 0 [pid 1448] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1446] <... futex resumed>) = 0 [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1450] <... futex resumed>) = 0 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1448] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... futex resumed>) = 0 ./strace-static-x86_64: Process 1454 attached [pid 1450] <... futex resumed>) = 0 [pid 1449] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 1455 attached ./strace-static-x86_64: Process 1453 attached [pid 1454] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1450] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1449] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1455] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1454] <... set_robust_list resumed>) = 0 [pid 1453] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1450] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1449] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1455] <... set_robust_list resumed>) = 0 [pid 1454] rt_sigprocmask(SIG_SETMASK, [], [pid 1453] <... set_robust_list resumed>) = 0 [ 34.287549][ T1434] EXT4-fs (loop0): 1 orphan inode deleted [ 34.300971][ T1447] loop4: detected capacity change from 0 to 512 [ 34.306394][ T1434] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.319523][ T1434] ext4 filesystem being mounted at /root/syzkaller.iF59aB/39/file1 supports timestamps until 2038 (0x7fffffff) [pid 1450] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1449] <... mprotect resumed>) = 0 [pid 1448] <... write resumed>) = 8 [pid 1455] rt_sigprocmask(SIG_SETMASK, [], [pid 1454] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1453] rt_sigprocmask(SIG_SETMASK, [], [pid 1450] <... mprotect resumed>) = 0 [pid 1449] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1448] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1454] memfd_create("syzkaller", 0 [pid 1453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1450] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1449] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1448] <... futex resumed>) = 1 [pid 1446] <... futex resumed>) = 0 [pid 1455] memfd_create("syzkaller", 0 [pid 1454] <... memfd_create resumed>) = 3 [pid 1453] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1450] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1449] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1448] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1446] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1455] <... memfd_create resumed>) = 3 [pid 1454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1453] <... open resumed>) = 3 [pid 1450] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1448] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1446] <... futex resumed>) = 0 [pid 1455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1454] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... clone3 resumed> => {parent_tid=[1456]}, 88) = 1456 [pid 1448] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1446] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1455] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1453] <... futex resumed>) = 1 [pid 1450] <... clone3 resumed> => {parent_tid=[1457]}, 88) = 1457 [pid 1449] rt_sigprocmask(SIG_SETMASK, [], [pid 1444] <... futex resumed>) = 0 [pid 1455] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1454] <... write resumed>) = 262144 [pid 1453] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1450] rt_sigprocmask(SIG_SETMASK, [], [pid 1449] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1444] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1455] <... write resumed>) = 262144 [pid 1454] munmap(0x7f0c41dcd000, 138412032 [pid 1453] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1450] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1449] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1444] <... futex resumed>) = 0 [pid 1455] munmap(0x7f0c41dcd000, 138412032 [pid 1454] <... munmap resumed>) = 0 [pid 1453] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1450] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... futex resumed>) = 0 [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1455] <... munmap resumed>) = 0 [pid 1454] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1453] <... mount resumed>) = 0 [pid 1450] <... futex resumed>) = 0 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1455] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1454] <... openat resumed>) = 4 [pid 1453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1455] <... openat resumed>) = 4 [pid 1454] ioctl(4, LOOP_SET_FD, 3 [pid 1453] <... futex resumed>) = 1 [pid 1444] <... futex resumed>) = 0 [pid 1455] ioctl(4, LOOP_SET_FD, 3 [pid 1453] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1448] <... write resumed>) = 1045 [pid 1444] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1453] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1444] <... futex resumed>) = 0 [pid 1453] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1453] <... open resumed>) = 4 [pid 1453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1444] <... futex resumed>) = 0 [pid 1453] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1444] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1453] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1444] <... futex resumed>) = 0 [pid 1453] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1453] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1444] <... futex resumed>) = 0 [pid 1453] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1444] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1453] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1444] <... futex resumed>) = 0 [pid 1453] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1444] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1453] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1444] <... futex resumed>) = 0 [pid 1453] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1448] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1455] <... ioctl resumed>) = 0 [pid 1455] close(3) = 0 [pid 1455] mkdir("./file1", 0777 [pid 1448] <... futex resumed>) = 1 [pid 1446] <... futex resumed>) = 0 [pid 1448] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 1457 attached ./strace-static-x86_64: Process 1456 attached ./strace-static-x86_64: Process 1452 attached [pid 1457] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1456] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1452] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1447] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1434] <... mount resumed>) = 0 [pid 1457] <... set_robust_list resumed>) = 0 [pid 1456] <... set_robust_list resumed>) = 0 [pid 1452] <... set_robust_list resumed>) = 0 [pid 1455] <... mkdir resumed>) = 0 [pid 1454] <... ioctl resumed>) = 0 [pid 1455] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1454] close(3) = 0 [pid 1454] mkdir("./file1", 0777) = 0 [pid 1454] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1447] ioctl(5, LOOP_CLR_FD) = 0 [pid 1447] close(5) = 0 [pid 1447] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1447] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1434] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 1434] chdir("./file1") = 0 [pid 1434] ioctl(6, LOOP_CLR_FD) = 0 [pid 1434] close(6) = 0 [pid 1434] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1434] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1433] exit_group(0 [pid 1434] <... futex resumed>) = ? [pid 1433] <... exit_group resumed>) = ? [ 34.339500][ T1438] EXT4-fs (loop3): 1 orphan inode deleted [ 34.345471][ T1438] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.355710][ T1454] loop2: detected capacity change from 0 to 512 [ 34.363385][ T1455] loop1: detected capacity change from 0 to 512 [ 34.364048][ T1447] EXT4-fs (loop4): Invalid log block size: 2475723007 [pid 1434] +++ exited with 0 +++ [pid 1457] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1457] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1456] rt_sigprocmask(SIG_SETMASK, [], [pid 1452] rt_sigprocmask(SIG_SETMASK, [], [pid 1435] <... futex resumed>) = ? [pid 1456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1446] exit_group(0 [pid 1435] +++ exited with 0 +++ [pid 1433] +++ exited with 0 +++ [pid 1456] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1452] memfd_create("syzkaller", 0 [pid 1448] <... futex resumed>) = ? [pid 1447] <... futex resumed>) = ? [pid 1446] <... exit_group resumed>) = ? [pid 1457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1456] <... open resumed>) = 3 [pid 1452] <... memfd_create resumed>) = 5 [pid 1448] +++ exited with 0 +++ [pid 1447] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1433, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1457] <... futex resumed>) = 1 [pid 1456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1452] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1450] <... futex resumed>) = 0 [pid 1457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1456] <... futex resumed>) = 1 [pid 1452] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1450] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] <... futex resumed>) = 0 [pid 1457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1450] <... futex resumed>) = 0 [pid 294] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1457] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1457] <... mount resumed>) = 0 [pid 1456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1452] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1449] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1456] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 294] <... openat resumed>) = 3 [pid 1457] <... futex resumed>) = 1 [pid 1456] <... mount resumed>) = 0 [pid 1452] <... write resumed>) = 262144 [pid 1450] <... futex resumed>) = 0 [pid 1449] <... futex resumed>) = 0 [pid 294] newfstatat(3, "", [pid 1457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1452] munmap(0x7f0c41dcd000, 138412032 [pid 1450] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1456] <... futex resumed>) = 0 [pid 1452] <... munmap resumed>) = 0 [pid 1450] <... futex resumed>) = 0 [pid 1449] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] getdents64(3, [pid 1457] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 34.379780][ T1438] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/38/bus supports timestamps until 2038 (0x7fffffff) [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1457] <... open resumed>) = 5 [pid 1456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1452] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1449] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1450] <... futex resumed>) = 0 [pid 1457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1450] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1450] <... futex resumed>) = 0 [pid 1457] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1456] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1452] <... openat resumed>) = 6 [pid 1452] ioctl(6, LOOP_SET_FD, 5 [pid 1457] <... write resumed>) = 8 [pid 1456] <... futex resumed>) = 0 [pid 1454] <... mount resumed>) = 0 [pid 1452] <... ioctl resumed>) = 0 [pid 1449] <... futex resumed>) = 1 [pid 1446] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 1457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1454] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1452] close(5 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1446, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 294] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1457] <... futex resumed>) = 1 [pid 1454] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1452] <... close resumed>) = 0 [pid 1450] <... futex resumed>) = 0 [pid 1449] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 34.413955][ T1454] EXT4-fs (loop2): 1 orphan inode deleted [ 34.419378][ T1452] loop5: detected capacity change from 0 to 512 [ 34.421777][ T1455] EXT4-fs (loop1): 1 orphan inode deleted [ 34.425906][ T1454] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.442232][ T1454] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/39/file1 supports timestamps until 2038 (0x7fffffff) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1454] ioctl(4, LOOP_CLR_FD [pid 1452] mkdir("./file1", 0777 [pid 1450] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1449] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1456] <... futex resumed>) = 0 [pid 1449] <... futex resumed>) = 1 [pid 1456] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1456] <... write resumed>) = 8 [pid 1456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1449] <... futex resumed>) = 0 [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1449] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1449] <... futex resumed>) = 0 [pid 1456] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1449] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1456] <... write resumed>) = 1045 [pid 1456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1449] <... futex resumed>) = 0 [pid 1456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] newfstatat(AT_FDCWD, "./39/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./39/bus") = 0 [pid 294] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./39/binderfs" [pid 1457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1454] <... ioctl resumed>) = 0 [pid 1452] <... mkdir resumed>) = 0 [pid 1450] <... futex resumed>) = 0 [pid 298] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 294] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1438] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1438] ioctl(6, LOOP_CLR_FD) = 0 [pid 1438] close(6 [pid 1457] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1455] <... mount resumed>) = 0 [pid 1454] close(4 [pid 1452] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1450] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1455] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1454] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1457] <... write resumed>) = 1045 [pid 1455] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1454] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 1457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1455] ioctl(4, LOOP_CLR_FD [pid 1454] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 1457] <... futex resumed>) = 1 [pid 1455] <... ioctl resumed>) = 0 [pid 1454] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1450] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1455] close(4 [pid 298] getdents64(3, [pid 1455] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1455] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1455] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 1455] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1449] exit_group(0 [pid 298] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1456] <... futex resumed>) = ? [pid 1454] <... futex resumed>) = ? [pid 1449] <... exit_group resumed>) = ? [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./38/bus", [pid 1454] +++ exited with 0 +++ [pid 1450] exit_group(0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1457] <... futex resumed>) = ? [pid 1456] +++ exited with 0 +++ [pid 1455] <... futex resumed>) = ? [pid 1450] <... exit_group resumed>) = ? [pid 298] unlink("./38/bus" [pid 1457] +++ exited with 0 +++ [pid 1455] +++ exited with 0 +++ [pid 1450] +++ exited with 0 +++ [pid 1449] +++ exited with 0 +++ [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1449, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1450, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./38/binderfs") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./38" [pid 1438] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 1438] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./39", 0777 [pid 1438] <... futex resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 1438] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 296] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... close resumed>) = 0 [pid 295] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1429] exit_group(0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... openat resumed>) = 3 [pid 1439] <... futex resumed>) = ? [pid 1438] <... futex resumed>) = ? [pid 1429] <... exit_group resumed>) = ? [pid 295] <... openat resumed>) = 3 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1463 [pid 1439] +++ exited with 0 +++ [pid 296] newfstatat(3, "", [pid 295] newfstatat(3, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 1438] +++ exited with 0 +++ [pid 1429] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1429, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 296] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./39/bus", [pid 295] newfstatat(AT_FDCWD, "./37/bus", [pid 297] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] unlink("./39/bus" [pid 295] unlink("./37/bus" [pid 297] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 297] newfstatat(3, "", [pid 296] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] getdents64(3, [pid 296] newfstatat(AT_FDCWD, "./39/binderfs", [pid 295] newfstatat(AT_FDCWD, "./37/binderfs", [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./39/binderfs" [pid 295] unlink("./37/binderfs" [pid 297] <... umount2 resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 297] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./38/bus", ./strace-static-x86_64: Process 1463 attached [pid 1463] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1463] chdir("./39") = 0 [pid 1463] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] unlink("./38/bus" [pid 1463] setpgid(0, 0) = 0 [pid 297] <... unlink resumed>) = 0 [pid 1463] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1463] write(3, "1000", 4) = 4 [pid 1463] close(3) = 0 [pid 1463] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1463] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1463] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1463] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./38/binderfs" [pid 1463] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] <... unlink resumed>) = 0 [pid 1463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] getdents64(3, [pid 1463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1463] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 297] close(3) = 0 [pid 1463] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] rmdir("./38" [pid 1463] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] <... rmdir resumed>) = 0 [pid 1463] <... clone3 resumed> => {parent_tid=[1465]}, 88) = 1465 [pid 297] mkdir("./39", 0777 [pid 1463] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1463] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 297] <... mkdir resumed>) = 0 [pid 1463] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1463] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = 0 [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1463] <... clone3 resumed> => {parent_tid=[1466]}, 88) = 1466 [pid 1463] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1467 ./strace-static-x86_64: Process 1465 attached [pid 1465] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1465] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1465] memfd_create("syzkaller", 0) = 3 [pid 1465] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 1467 attached [ 34.458792][ T1455] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.470207][ T1455] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/37/file1 supports timestamps until 2038 (0x7fffffff) [pid 1465] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 1466 attached [pid 1467] set_robust_list(0x555556d8d6a0, 24 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 1466] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1465] <... write resumed>) = 262144 [pid 1466] <... set_robust_list resumed>) = 0 [pid 1466] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1466] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 1466] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1463] <... futex resumed>) = 0 [pid 1466] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1466] <... mount resumed>) = 0 [pid 1463] <... futex resumed>) = 0 [pid 1466] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1466] <... futex resumed>) = 0 [pid 1463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1466] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1465] munmap(0x7f0c41dcd000, 138412032 [pid 1463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1466] <... open resumed>) = 5 [pid 1465] <... munmap resumed>) = 0 [pid 1463] <... futex resumed>) = 0 [pid 1466] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1465] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1466] <... futex resumed>) = 0 [pid 1465] <... openat resumed>) = 6 [pid 1463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1466] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1465] ioctl(6, LOOP_SET_FD, 3 [pid 1463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1466] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1463] <... futex resumed>) = 0 [pid 294] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1467] <... set_robust_list resumed>) = 0 [pid 1466] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./39/file1", [pid 295] newfstatat(AT_FDCWD, "./37/file1", [pid 294] newfstatat(AT_FDCWD, "./39/file1", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1466] <... futex resumed>) = 0 [pid 1463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] openat(AT_FDCWD, "./39/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1466] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1467] chdir("./39" [pid 1466] <... write resumed>) = -1 EIO (Input/output error) [pid 1463] <... futex resumed>) = 0 [pid 1466] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1466] <... futex resumed>) = 0 [pid 1463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1466] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1465] <... ioctl resumed>) = 0 [pid 1465] close(3) = 0 [pid 1465] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 1465] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] newfstatat(4, "", [pid 295] <... openat resumed>) = 4 [pid 294] openat(AT_FDCWD, "./39/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, [pid 295] newfstatat(4, "", [pid 294] newfstatat(4, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, [pid 295] getdents64(4, [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] getdents64(4, [pid 296] close(4 [pid 295] close(4 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 296] rmdir("./39/file1" [pid 295] rmdir("./37/file1" [pid 294] close(4 [pid 296] <... rmdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 294] rmdir("./39/file1" [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 295] close(3 [pid 294] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./39" [pid 295] <... close resumed>) = 0 [pid 294] getdents64(3, [pid 296] <... rmdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./37" [pid 296] mkdir("./40", 0777 [pid 294] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 1467] <... chdir resumed>) = 0 [pid 1467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] mkdir("./38", 0777 [pid 294] rmdir("./39" [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1467] setpgid(0, 0) = 0 [pid 1467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... mkdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] mkdir("./40", 0777 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1467] <... openat resumed>) = 3 [pid 1467] write(3, "1000", 4) = 4 [pid 294] <... mkdir resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... openat resumed>) = 3 [pid 296] close(3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 296] <... close resumed>) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... openat resumed>) = 3 [pid 295] close(3 [pid 1467] close(3) = 0 [pid 1467] symlink("/dev/binderfs", "./binderfs" [pid 295] <... close resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1468 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3 [pid 1467] <... symlink resumed>) = 0 [pid 1467] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1467] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 294] <... close resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1469 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1467] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1467] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1467] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1470 [pid 1467] <... mprotect resumed>) = 0 [pid 1467] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ./strace-static-x86_64: Process 1470 attached [pid 1467] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1471]}, 88) = 1471 ./strace-static-x86_64: Process 1471 attached ./strace-static-x86_64: Process 1469 attached ./strace-static-x86_64: Process 1468 attached [pid 1470] set_robust_list(0x555556d8d6a0, 24 [pid 1467] rt_sigprocmask(SIG_SETMASK, [], [pid 1471] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1470] <... set_robust_list resumed>) = 0 [pid 1469] set_robust_list(0x555556d8d6a0, 24 [pid 1468] set_robust_list(0x555556d8d6a0, 24 [pid 1467] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1467] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1467] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1467] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1467] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1467] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0}./strace-static-x86_64: Process 1472 attached [pid 1471] <... set_robust_list resumed>) = 0 [pid 1470] chdir("./40" [pid 1469] <... set_robust_list resumed>) = 0 [pid 1468] <... set_robust_list resumed>) = 0 [pid 1467] <... clone3 resumed> => {parent_tid=[1472]}, 88) = 1472 [pid 1467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1472] set_robust_list(0x7f0c4a1ed9a0, 24 [ 34.513908][ T1452] EXT4-fs (loop5): 1 orphan inode deleted [ 34.524838][ T1465] loop4: detected capacity change from 0 to 512 [ 34.532196][ T43] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 34.534572][ T1452] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 1471] rt_sigprocmask(SIG_SETMASK, [], [pid 1470] <... chdir resumed>) = 0 [pid 1469] chdir("./38" [pid 1468] chdir("./40" [pid 1467] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1472] <... set_robust_list resumed>) = 0 [pid 1471] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1470] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1469] <... chdir resumed>) = 0 [pid 1468] <... chdir resumed>) = 0 [pid 1467] <... futex resumed>) = 0 [pid 1472] rt_sigprocmask(SIG_SETMASK, [], [pid 1471] memfd_create("syzkaller", 0 [pid 1470] <... prctl resumed>) = 0 [pid 1469] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1468] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1472] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1471] <... memfd_create resumed>) = 3 [pid 1470] setpgid(0, 0 [pid 1469] <... prctl resumed>) = 0 [pid 1468] <... prctl resumed>) = 0 [pid 1472] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1471] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1470] <... setpgid resumed>) = 0 [pid 1469] setpgid(0, 0 [pid 1468] setpgid(0, 0 [pid 1472] <... open resumed>) = 4 [pid 1471] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1469] <... setpgid resumed>) = 0 [pid 1468] <... setpgid resumed>) = 0 [pid 1472] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1471] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1470] <... openat resumed>) = 3 [pid 1469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1472] <... futex resumed>) = 0 [pid 1471] <... write resumed>) = 262144 [pid 1470] write(3, "1000", 4 [pid 1469] <... openat resumed>) = 3 [pid 1468] <... openat resumed>) = 3 [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1472] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1471] munmap(0x7f0c41dcd000, 138412032 [pid 1470] <... write resumed>) = 4 [pid 1469] write(3, "1000", 4 [pid 1468] write(3, "1000", 4 [pid 1471] <... munmap resumed>) = 0 [pid 1470] close(3 [pid 1469] <... write resumed>) = 4 [pid 1468] <... write resumed>) = 4 [pid 1471] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 1470] <... close resumed>) = 0 [pid 1469] close(3 [pid 1468] close(3 [pid 1471] <... openat resumed>) = 5 [pid 1470] symlink("/dev/binderfs", "./binderfs" [pid 1469] <... close resumed>) = 0 [pid 1468] <... close resumed>) = 0 [pid 1471] ioctl(5, LOOP_SET_FD, 3 [pid 1470] <... symlink resumed>) = 0 [pid 1469] symlink("/dev/binderfs", "./binderfs" [pid 1468] symlink("/dev/binderfs", "./binderfs" [pid 1467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 34.571157][ T1465] EXT4-fs (loop4): 1 orphan inode deleted [ 34.576702][ T1465] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.593918][ T1452] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/41/file1 supports timestamps until 2038 (0x7fffffff) [ 34.605813][ T1465] ext4 filesystem being mounted at /root/syzkaller.qPQybd/39/bus supports timestamps until 2038 (0x7fffffff) [pid 1452] <... mount resumed>) = 0 [pid 1471] <... ioctl resumed>) = 0 [pid 1470] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] <... symlink resumed>) = 0 [pid 1468] <... symlink resumed>) = 0 [pid 1467] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1452] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 1472] <... futex resumed>) = 0 [pid 1471] close(3 [pid 1470] <... futex resumed>) = 0 [pid 1469] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1467] <... futex resumed>) = 1 [pid 1452] <... openat resumed>) = 5 [pid 1472] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1471] <... close resumed>) = 0 [pid 1470] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1469] <... futex resumed>) = 0 [pid 1468] <... futex resumed>) = 0 [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1452] chdir("./file1" [pid 1472] <... mount resumed>) = 0 [pid 1471] mkdir("./bus", 0777 [pid 1470] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1469] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1468] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1452] <... chdir resumed>) = 0 [pid 1472] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1471] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1470] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1469] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1468] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1452] ioctl(6, LOOP_CLR_FD [pid 1472] <... futex resumed>) = 1 [pid 1471] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1469] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1468] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1467] <... futex resumed>) = 0 [pid 1452] <... ioctl resumed>) = 0 [pid 1472] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1467] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1452] close(6 [pid 1472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1470] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1467] <... futex resumed>) = 0 [pid 1470] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1469] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1468] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1470] <... mprotect resumed>) = 0 [pid 1469] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1468] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1470] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1469] <... mprotect resumed>) = 0 [pid 1468] <... mprotect resumed>) = 0 [pid 1470] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1469] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1468] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1469] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1468] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1470] <... clone3 resumed> => {parent_tid=[1476]}, 88) = 1476 [pid 1470] rt_sigprocmask(SIG_SETMASK, [], [pid 1469] <... clone3 resumed> => {parent_tid=[1477]}, 88) = 1477 [pid 1468] <... clone3 resumed> => {parent_tid=[1478]}, 88) = 1478 [pid 1470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1469] rt_sigprocmask(SIG_SETMASK, [], [pid 1468] rt_sigprocmask(SIG_SETMASK, [], [pid 1470] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1470] <... futex resumed>) = 0 [pid 1469] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] <... futex resumed>) = 0 [pid 1468] <... futex resumed>) = 0 [pid 1470] <... futex resumed>) = 0 [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1469] <... futex resumed>) = 0 [pid 1468] <... futex resumed>) = 0 [pid 1470] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1470] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1469] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1468] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1470] <... mprotect resumed>) = 0 [pid 1469] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1468] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1470] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1469] <... mprotect resumed>) = 0 [pid 1468] <... mprotect resumed>) = 0 [pid 1470] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1469] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1468] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1469] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1468] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1472] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1472] <... open resumed>) = 3 [pid 1470] <... clone3 resumed> => {parent_tid=[1479]}, 88) = 1479 [pid 1472] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] rt_sigprocmask(SIG_SETMASK, [], [pid 1469] <... clone3 resumed> => {parent_tid=[1481]}, 88) = 1481 [pid 1468] <... clone3 resumed> => {parent_tid=[1482]}, 88) = 1482 [pid 1470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1469] rt_sigprocmask(SIG_SETMASK, [], [pid 1468] rt_sigprocmask(SIG_SETMASK, [], [pid 1470] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1470] <... futex resumed>) = 0 [pid 1469] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1469] <... futex resumed>) = 0 [pid 1468] <... futex resumed>) = 0 [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1468] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1472] <... futex resumed>) = 1 [pid 1467] <... futex resumed>) = 0 [pid 1472] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1467] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1467] <... futex resumed>) = 0 [pid 1472] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1472] <... write resumed>) = 8 [pid 1472] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1452] <... close resumed>) = 0 ./strace-static-x86_64: Process 1476 attached [pid 1476] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1476] memfd_create("syzkaller", 0) = 3 [pid 1476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1476] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1476] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 34.614503][ T1471] loop3: detected capacity change from 0 to 512 [ 34.636054][ T1471] EXT4-fs (loop3): 1 orphan inode deleted [ 34.640802][ T1476] loop0: detected capacity change from 0 to 512 [ 34.642515][ T1471] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.654297][ T1477] loop1: detected capacity change from 0 to 512 [pid 1476] ioctl(4, LOOP_SET_FD, 3 [pid 1472] <... futex resumed>) = 1 [pid 1467] <... futex resumed>) = 0 [pid 1452] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1476] <... ioctl resumed>) = 0 [pid 1476] close(3) = 0 [pid 1476] mkdir("./file1", 0777) = 0 [pid 1476] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 1477 attached [pid 1477] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1477] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1477] memfd_create("syzkaller", 0) = 3 [pid 1477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1477] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1477] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1477] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 1477] ioctl(4, LOOP_SET_FD, 3 [pid 1472] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1467] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1467] <... futex resumed>) = 0 [pid 1452] <... futex resumed>) = 0 [pid 1472] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1467] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1444] exit_group(0 [pid 1452] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1453] <... futex resumed>) = ? [pid 1444] <... exit_group resumed>) = ? [pid 1477] <... ioctl resumed>) = 0 [pid 1453] +++ exited with 0 +++ [pid 1477] close(3) = 0 [pid 1477] mkdir("./file1", 0777 [pid 1472] <... write resumed>) = 1045 [pid 1452] <... futex resumed>) = ? [pid 1472] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1477] <... mkdir resumed>) = 0 [pid 1477] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1452] +++ exited with 0 +++ [pid 1444] +++ exited with 0 +++ ./strace-static-x86_64: Process 1478 attached [pid 1478] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1478] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1478] memfd_create("syzkaller", 0) = 3 [pid 1478] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1478] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1444, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1472] <... futex resumed>) = 1 [pid 1467] <... futex resumed>) = 0 [pid 1472] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./41/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./41/bus") = 0 [pid 299] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1478] <... write resumed>) = 262144 [pid 1478] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1478] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 1478] ioctl(4, LOOP_SET_FD, 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./41/binderfs"./strace-static-x86_64: Process 1479 attached [pid 1479] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 299] <... unlink resumed>) = 0 [pid 1479] rt_sigprocmask(SIG_SETMASK, [], [pid 299] umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1479] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 1479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] <... futex resumed>) = 0 [pid 1470] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1479] <... futex resumed>) = 1 [pid 1479] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] <... futex resumed>) = 0 [pid 1470] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1479] <... futex resumed>) = 1 [pid 1479] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 1479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] <... futex resumed>) = 0 [pid 1470] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1479] <... futex resumed>) = 1 [pid 1479] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8./strace-static-x86_64: Process 1481 attached [pid 1481] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1479] <... write resumed>) = 8 [pid 1481] <... set_robust_list resumed>) = 0 [pid 1481] rt_sigprocmask(SIG_SETMASK, [], [pid 1479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] <... futex resumed>) = 0 [pid 1470] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1481] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1479] <... futex resumed>) = 1 [pid 1470] <... futex resumed>) = 0 [pid 1481] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1479] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1470] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1481] <... open resumed>) = 3 [pid 1465] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1481] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1469] <... futex resumed>) = 0 [pid 1481] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1469] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1481] <... mount resumed>) = 0 [pid 1469] <... futex resumed>) = 0 [pid 1468] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 1481] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1468] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1481] <... futex resumed>) = 0 [pid 1469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1468] <... futex resumed>) = 0 [pid 1481] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1469] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1481] <... open resumed>) = 5 [pid 1469] <... futex resumed>) = 0 [pid 1468] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 1481] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1468] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 1481] <... futex resumed>) = 0 [pid 1469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1468] <... mprotect resumed>) = 0 [pid 1481] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1469] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1469] <... futex resumed>) = 0 [pid 1468] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} => {parent_tid=[1484]}, 88) = 1484 [pid 1468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1468] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1468] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1482 attached [pid 1482] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1482] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 1482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1479] <... write resumed>) = 1045 [pid 1478] <... ioctl resumed>) = 0 [pid 1465] ioctl(6, LOOP_CLR_FD./strace-static-x86_64: Process 1484 attached [pid 1484] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 1484] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1481] <... write resumed>) = 8 [pid 1481] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1469] <... futex resumed>) = 0 [pid 1481] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1469] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 34.671880][ T1478] loop2: detected capacity change from 0 to 512 [ 34.682985][ T1476] EXT4-fs (loop0): fragment/cluster size (0) != block size (4096) [ 34.686171][ T1471] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/39/bus supports timestamps until 2038 (0x7fffffff) [ 34.693521][ T1477] EXT4-fs (loop1): 1 orphan inode deleted [ 34.708868][ T1477] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 1469] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1484] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1478] close(3 [pid 1476] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 1465] <... ioctl resumed>) = 0 [pid 1481] <... write resumed>) = 1045 [pid 1481] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1465] close(6 [pid 1481] <... futex resumed>) = 1 [pid 1469] <... futex resumed>) = 0 [pid 1465] <... close resumed>) = 0 [pid 1481] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1465] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1465] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1463] exit_group(0 [pid 1466] <... futex resumed>) = ? [pid 1465] <... futex resumed>) = ? [pid 1463] <... exit_group resumed>) = ? [pid 1466] +++ exited with 0 +++ [pid 1465] +++ exited with 0 +++ [pid 1463] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1463, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 1484] <... mount resumed>) = 0 [pid 1479] <... futex resumed>) = 1 [pid 1478] <... close resumed>) = 0 [pid 1477] <... mount resumed>) = 0 [pid 1476] ioctl(4, LOOP_CLR_FD [pid 1471] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1470] <... futex resumed>) = 0 [pid 299] umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1471] ioctl(5, LOOP_CLR_FD [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1471] <... ioctl resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./41/file1", [pid 298] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1471] close(5 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1471] <... close resumed>) = 0 [pid 299] umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1471] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 3 [pid 1479] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1478] mkdir("./bus", 0777 [pid 1471] <... futex resumed>) = 0 [pid 1468] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1467] exit_group(0 [pid 299] openat(AT_FDCWD, "./41/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(3, "", [pid 1482] <... futex resumed>) = 0 [pid 1472] <... futex resumed>) = ? [pid 1468] <... futex resumed>) = 1 [pid 1467] <... exit_group resumed>) = ? [pid 299] <... openat resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1482] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1478] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1472] +++ exited with 0 +++ [pid 1471] +++ exited with 0 +++ [pid 1468] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] newfstatat(4, "", [pid 298] getdents64(3, [pid 1484] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 1482] <... open resumed>) = 3 [pid 1478] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1477] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1476] <... ioctl resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 298] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1482] <... futex resumed>) = 1 [pid 1468] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] <... umount2 resumed>) = 0 [pid 1482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1468] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 298] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1484] <... futex resumed>) = 0 [pid 1482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1477] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1476] close(4 [pid 1468] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1482] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1468] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] close(4 [pid 298] newfstatat(AT_FDCWD, "./39/bus", [pid 1484] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1482] <... write resumed>) = 8 [pid 1477] ioctl(4, LOOP_CLR_FD [pid 299] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./41/file1" [pid 298] unlink("./39/bus" [pid 1482] <... futex resumed>) = 1 [pid 1468] <... futex resumed>) = 0 [pid 1476] <... close resumed>) = 0 [pid 1476] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1468] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 1482] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1476] <... futex resumed>) = 0 [pid 1476] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... unlink resumed>) = 0 [pid 1468] <... futex resumed>) = 0 [pid 1477] <... ioctl resumed>) = 0 [pid 1468] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1477] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1482] <... write resumed>) = 1045 [pid 299] getdents64(3, [pid 298] newfstatat(AT_FDCWD, "./39/binderfs", [pid 1482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1482] <... futex resumed>) = 1 [pid 1468] <... futex resumed>) = 0 [pid 1477] <... close resumed>) = 0 [pid 299] close(3 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1477] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1470] exit_group(0 [pid 1469] exit_group(0 [pid 299] <... close resumed>) = 0 [pid 298] unlink("./39/binderfs" [pid 1481] <... futex resumed>) = ? [pid 1479] <... futex resumed>) = ? [pid 1477] <... futex resumed>) = ? [pid 1476] <... futex resumed>) = ? [pid 1470] <... exit_group resumed>) = ? [pid 1469] <... exit_group resumed>) = ? [pid 299] rmdir("./41" [pid 1481] +++ exited with 0 +++ [pid 1479] +++ exited with 0 +++ [pid 299] <... rmdir resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 299] mkdir("./42", 0777 [pid 298] getdents64(3, [pid 299] <... mkdir resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1477] +++ exited with 0 +++ [pid 1469] +++ exited with 0 +++ [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] close(3 [pid 299] <... openat resumed>) = 3 [pid 298] <... close resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] rmdir("./39" [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... rmdir resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1469, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] close(3 [pid 298] mkdir("./40", 0777 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 299] <... close resumed>) = 0 [pid 295] <... restart_syscall resumed>) = 0 [pid 295] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... mkdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] getdents64(3, [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1487 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./38/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 1487 attached [pid 295] unlink("./38/bus" [pid 1487] set_robust_list(0x555556d8d6a0, 24 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./38/binderfs" [pid 1487] <... set_robust_list resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1487] chdir("./42") = 0 [pid 1487] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1487] setpgid(0, 0) = 0 [pid 1487] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1487] write(3, "1000", 4) = 4 [pid 1487] close(3) = 0 [pid 1487] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1487] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1487] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1487] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1487] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1487] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1490]}, 88) = 1490 [pid 1487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1487] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1487] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1487] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1491]}, 88) = 1491 [pid 1487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1487] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1490 attached [pid 1490] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1490] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1490] memfd_create("syzkaller", 0) = 3 ./strace-static-x86_64: Process 1491 attached [ 34.720046][ T1477] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/38/file1 supports timestamps until 2038 (0x7fffffff) [ 34.750668][ T1478] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 1490] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1467] +++ exited with 0 +++ [pid 298] <... openat resumed>) = 3 [pid 1476] +++ exited with 0 +++ [pid 1470] +++ exited with 0 +++ [pid 1490] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1490] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1491] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1467, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1470, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 1491] <... set_robust_list resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1491] rt_sigprocmask(SIG_SETMASK, [], [pid 298] close(3 [pid 1491] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1490] <... write resumed>) = 262144 [pid 1491] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1490] munmap(0x7f0c41dcd000, 138412032 [pid 298] <... close resumed>) = 0 [pid 1491] <... open resumed>) = 4 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1487] <... futex resumed>) = 0 [pid 1491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1490] <... munmap resumed>) = 0 [pid 1487] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1478] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1492 [pid 297] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1491] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1490] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1487] <... futex resumed>) = 0 [pid 1491] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1490] <... openat resumed>) = 5 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1478] ioctl(4, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1491] <... mount resumed>) = 0 [pid 1490] ioctl(5, LOOP_SET_FD, 3 [pid 1478] <... ioctl resumed>) = 0 [pid 297] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1492 attached [pid 1492] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1492] chdir("./40") = 0 [pid 1492] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1492] setpgid(0, 0) = 0 [pid 1492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1492] write(3, "1000", 4) = 4 [pid 1492] close(3) = 0 [pid 1492] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1491] <... futex resumed>) = 1 [pid 1490] <... ioctl resumed>) = 0 [pid 1487] <... futex resumed>) = 0 [pid 1478] close(4 [pid 297] <... openat resumed>) = 3 [pid 294] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1492] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1487] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1478] <... close resumed>) = 0 [pid 297] newfstatat(3, "", [pid 294] <... openat resumed>) = 3 [pid 1491] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1487] <... futex resumed>) = 0 [pid 1478] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(3, "", [pid 1491] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1490] close(3 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1478] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1491] <... open resumed>) = 6 [pid 1490] <... close resumed>) = 0 [pid 1478] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] getdents64(3, [pid 1491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1490] mkdir("./bus", 0777 [pid 297] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1491] <... futex resumed>) = 1 [pid 1490] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1487] <... futex resumed>) = 0 [pid 1468] exit_group(0 [pid 297] <... umount2 resumed>) = 0 [pid 294] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1490] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1487] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1484] <... futex resumed>) = ? [pid 1482] <... futex resumed>) = ? [pid 1478] <... futex resumed>) = ? [pid 1468] <... exit_group resumed>) = ? [pid 297] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 1492] <... futex resumed>) = 0 [pid 1491] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1487] <... futex resumed>) = 0 [pid 1484] +++ exited with 0 +++ [pid 1482] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1492] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1492] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1491] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./39/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1492] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1491] <... write resumed>) = 8 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./39/bus" [pid 294] newfstatat(AT_FDCWD, "./40/bus", [pid 1491] <... futex resumed>) = 1 [pid 1487] <... futex resumed>) = 0 [pid 1492] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 297] <... unlink resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1492] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1491] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1487] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] unlink("./40/bus" [pid 1492] <... mprotect resumed>) = 0 [pid 1487] <... futex resumed>) = 0 [pid 1492] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 294] <... unlink resumed>) = 0 [pid 1491] <... write resumed>) = 1045 [pid 1487] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1487] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] newfstatat(AT_FDCWD, "./39/binderfs", [pid 1491] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] unlink("./39/binderfs" [pid 294] newfstatat(AT_FDCWD, "./40/binderfs", [pid 1492] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] <... unlink resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1492] <... clone3 resumed> => {parent_tid=[1494]}, 88) = 1494 [pid 297] getdents64(3, [pid 294] unlink("./40/binderfs" [pid 1492] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1492] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1492] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1492] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1492] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1492] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[1496]}, 88) = 1496 [pid 1492] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1492] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1494 attached [pid 1494] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1494] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1494] memfd_create("syzkaller", 0) = 3 [pid 1494] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1494] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1494] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1494] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 1494] ioctl(4, LOOP_SET_FD, 3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 297] close(3 [pid 295] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] rmdir("./39" [pid 295] newfstatat(AT_FDCWD, "./38/file1", [pid 294] newfstatat(AT_FDCWD, "./40/file1", [pid 1494] <... ioctl resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./40", 0777 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1494] close(3 [pid 297] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./38/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1494] <... close resumed>) = 0 [pid 1494] mkdir("./file1", 0777 [pid 294] <... openat resumed>) = 4 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] newfstatat(4, "", [pid 297] close(3 [pid 295] <... openat resumed>) = 4 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... close resumed>) = 0 [pid 295] newfstatat(4, "", [pid 294] getdents64(4, [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 1494] <... mkdir resumed>) = 0 [pid 1494] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1497 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4 [pid 295] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 295] close(4 [pid 294] rmdir("./40/file1"./strace-static-x86_64: Process 1497 attached [pid 1497] set_robust_list(0x555556d8d6a0, 24 [pid 294] <... rmdir resumed>) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 1497] <... set_robust_list resumed>) = 0 [pid 1497] chdir("./40") = 0 [pid 1478] +++ exited with 0 +++ [pid 1468] +++ exited with 0 +++ [pid 294] rmdir("./40" [pid 295] <... close resumed>) = 0 [pid 1497] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 294] <... rmdir resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1468, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] rmdir("./38/file1" [pid 294] mkdir("./41", 0777 [pid 296] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1497] <... prctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... rmdir resumed>) = 0 [pid 1497] setpgid(0, 0 [pid 296] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 294] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 296] newfstatat(3, "", [pid 295] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... openat resumed>) = 3 [pid 296] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] rmdir("./38" [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1497] <... setpgid resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] mkdir("./39", 0777 [pid 294] close(3 [pid 296] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1497] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... mkdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./40/bus", [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./40/bus" [pid 295] <... openat resumed>) = 3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 1498 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] newfstatat(AT_FDCWD, "./40/binderfs", [pid 295] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./40/binderfs" [pid 295] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 1499 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./40" [pid 1497] <... openat resumed>) = 3 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./41", 0777 [pid 1497] write(3, "1000", 4 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 ./strace-static-x86_64: Process 1496 attached [pid 296] ioctl(3, LOOP_CLR_FD [pid 1496] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1496] <... set_robust_list resumed>) = 0 [pid 296] close(3 [pid 1496] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... close resumed>) = 0 [pid 1496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1496] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1497] <... write resumed>) = 4 [pid 1497] close(3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1501 [pid 1496] <... open resumed>) = 3 [pid 1496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1497] <... close resumed>) = 0 [pid 1496] <... futex resumed>) = 1 [pid 1492] <... futex resumed>) = 0 [pid 1497] symlink("/dev/binderfs", "./binderfs" [pid 1492] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1496] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 1492] <... futex resumed>) = 0 [pid 1496] <... mount resumed>) = 0 [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1497] <... symlink resumed>) = 0 [pid 1497] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1497] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1497] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1497] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1492] <... futex resumed>) = 0 [pid 1496] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1492] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1492] <... futex resumed>) = 0 [pid 1496] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1496] <... open resumed>) = 5 ./strace-static-x86_64: Process 1501 attached ./strace-static-x86_64: Process 1499 attached ./strace-static-x86_64: Process 1498 attached [pid 1497] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1492] <... futex resumed>) = 0 [pid 1501] set_robust_list(0x555556d8d6a0, 24 [pid 1499] set_robust_list(0x555556d8d6a0, 24 [pid 1498] set_robust_list(0x555556d8d6a0, 24 [pid 1497] <... mprotect resumed>) = 0 [pid 1496] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1492] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1501] <... set_robust_list resumed>) = 0 [pid 1499] <... set_robust_list resumed>) = 0 [pid 1498] <... set_robust_list resumed>) = 0 [pid 1497] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1492] <... futex resumed>) = 0 [pid 1501] chdir("./41" [pid 1499] chdir("./39" [pid 1498] chdir("./41" [pid 1497] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1496] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1501] <... chdir resumed>) = 0 [pid 1499] <... chdir resumed>) = 0 [pid 1498] <... chdir resumed>) = 0 [pid 1497] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1496] <... write resumed>) = 8 [pid 1501] prctl(PR_SET_PDEATHSIG, SIGKILL [ 34.768650][ T1478] EXT4-fs (loop2): get root inode failed [ 34.776957][ T1478] EXT4-fs (loop2): mount failed [ 34.786614][ T1490] loop5: detected capacity change from 0 to 512 [ 34.800510][ T1490] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 34.810031][ T1494] loop4: detected capacity change from 0 to 512 [pid 1499] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1498] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1501] <... prctl resumed>) = 0 [pid 1499] <... prctl resumed>) = 0 [pid 1498] <... prctl resumed>) = 0 [pid 1497] <... clone3 resumed> => {parent_tid=[1503]}, 88) = 1503 [pid 1496] <... futex resumed>) = 1 [pid 1492] <... futex resumed>) = 0 [pid 1501] setpgid(0, 0 [pid 1499] setpgid(0, 0 [pid 1498] setpgid(0, 0 [pid 1497] rt_sigprocmask(SIG_SETMASK, [], [pid 1496] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1492] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 1503 attached [pid 1501] <... setpgid resumed>) = 0 [pid 1499] <... setpgid resumed>) = 0 [pid 1503] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1503] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1498] <... setpgid resumed>) = 0 [pid 1497] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1492] <... futex resumed>) = 0 [pid 1490] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1501] <... openat resumed>) = 3 [pid 1499] <... openat resumed>) = 3 [pid 1498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1497] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1496] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1492] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1503] <... futex resumed>) = 0 [pid 1501] write(3, "1000", 4 [pid 1499] write(3, "1000", 4 [pid 1497] <... futex resumed>) = 1 [pid 1496] <... write resumed>) = 1045 [pid 1498] <... openat resumed>) = 3 [pid 1503] memfd_create("syzkaller", 0 [pid 1501] <... write resumed>) = 4 [pid 1499] <... write resumed>) = 4 [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1503] <... memfd_create resumed>) = 3 [pid 1501] close(3 [pid 1499] close(3 [pid 1498] write(3, "1000", 4 [pid 1497] <... futex resumed>) = 0 [pid 1496] <... futex resumed>) = 1 [pid 1492] <... futex resumed>) = 0 [pid 1490] ioctl(5, LOOP_CLR_FD [pid 1503] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1501] <... close resumed>) = 0 [pid 1499] <... close resumed>) = 0 [pid 1498] <... write resumed>) = 4 [pid 1497] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1496] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1490] <... ioctl resumed>) = 0 [pid 1503] <... mmap resumed>) = 0x7f0c41dee000 [pid 1501] symlink("/dev/binderfs", "./binderfs" [pid 1499] symlink("/dev/binderfs", "./binderfs" [pid 1498] close(3 [pid 1497] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1490] close(5 [pid 1503] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 1503] munmap(0x7f0c41dee000, 138412032) = 0 [ 34.852073][ T1490] EXT4-fs (loop5): get root inode failed [ 34.874552][ T1490] EXT4-fs (loop5): mount failed [ 34.876063][ T1494] EXT4-fs (loop4): 1 orphan inode deleted [pid 1503] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 1503] ioctl(4, LOOP_SET_FD, 3 [pid 1501] <... symlink resumed>) = 0 [pid 1499] <... symlink resumed>) = 0 [pid 1498] <... close resumed>) = 0 [pid 1497] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 1490] <... close resumed>) = 0 [pid 1503] <... ioctl resumed>) = 0 [pid 1503] close(3) = 0 [pid 1503] mkdir("./file1", 0777) = 0 [pid 1503] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1501] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1501] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1501] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1501] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1499] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] symlink("/dev/binderfs", "./binderfs" [pid 1497] <... mprotect resumed>) = 0 [pid 1490] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] <... futex resumed>) = 0 [pid 1501] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1498] <... symlink resumed>) = 0 [pid 1497] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1490] <... futex resumed>) = 0 [pid 1499] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1497] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1490] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1499] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1498] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1497] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 1499] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1498] <... futex resumed>) = 0 [pid 1501] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1499] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1498] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1501] <... mprotect resumed>) = 0 [pid 1499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1498] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1497] <... clone3 resumed> => {parent_tid=[1504]}, 88) = 1504 [pid 1487] exit_group(0 [pid 1501] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1499] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1498] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 1491] <... futex resumed>) = ? [pid 1487] <... exit_group resumed>) = ? [pid 1501] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1499] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1497] rt_sigprocmask(SIG_SETMASK, [], [pid 1491] +++ exited with 0 +++ [pid 1490] <... futex resumed>) = ? [pid 1501] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1499] <... mprotect resumed>) = 0 [pid 1497] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1501] <... clone3 resumed> => {parent_tid=[1505]}, 88) = 1505 [pid 1490] +++ exited with 0 +++ [pid 1487] +++ exited with 0 +++ [pid 1501] rt_sigprocmask(SIG_SETMASK, [], [pid 1499] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1498] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1497] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1487, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 1501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1499] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1498] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1497] <... futex resumed>) = 0 [pid 1501] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1498] <... mprotect resumed>) = 0 [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1501] <... futex resumed>) = 0 [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1498] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 1506 attached ./strace-static-x86_64: Process 1505 attached ./strace-static-x86_64: Process 1504 attached [pid 1501] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1499] <... clone3 resumed> => {parent_tid=[1506]}, 88) = 1506 [pid 1498] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1501] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1501] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1506] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1505] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1506] <... set_robust_list resumed>) = 0 [pid 1504] set_robust_list(0x7f0c41ded9a0, 24 [pid 1505] <... set_robust_list resumed>) = 0 [pid 1501] <... mprotect resumed>) = 0 [pid 1499] rt_sigprocmask(SIG_SETMASK, [], [pid 1498] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1501] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1501] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1501] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... openat resumed>) = 3 [pid 299] newfstatat(3, "", [pid 1501] <... clone3 resumed> => {parent_tid=[1508]}, 88) = 1508 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1501] rt_sigprocmask(SIG_SETMASK, [], [pid 299] getdents64(3, [pid 1501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 1501] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./42/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1501] <... futex resumed>) = 0 [pid 1499] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 1504] <... set_robust_list resumed>) = 0 [pid 1506] rt_sigprocmask(SIG_SETMASK, [], [pid 1505] rt_sigprocmask(SIG_SETMASK, [], [pid 1504] rt_sigprocmask(SIG_SETMASK, [], [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1499] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] <... clone3 resumed> => {parent_tid=[1509]}, 88) = 1509 [pid 299] umount2("./42/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1506] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1505] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1504] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1499] <... futex resumed>) = 0 [pid 1498] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./42/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./42/bus" [pid 1505] memfd_create("syzkaller", 0 [pid 1504] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 1506] memfd_create("syzkaller", 0 [pid 1498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1506] <... memfd_create resumed>) = 3 [pid 1505] <... memfd_create resumed>) = 3 [pid 1504] <... open resumed>) = 3 [pid 1499] <... futex resumed>) = 0 [pid 1498] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 1508 attached [pid 1506] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1504] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1498] <... futex resumed>) = 0 [pid 1494] <... mount resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./42/binderfs", ./strace-static-x86_64: Process 1509 attached [pid 1508] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1506] <... mmap resumed>) = 0x7f0c41dee000 [pid 1505] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1504] <... futex resumed>) = 1 [pid 1499] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1497] <... futex resumed>) = 0 [pid 1494] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1508] <... set_robust_list resumed>) = 0 [pid 1494] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 299] unlink("./42/binderfs" [pid 1508] rt_sigprocmask(SIG_SETMASK, [], [pid 1494] ioctl(4, LOOP_CLR_FD [pid 299] <... unlink resumed>) = 0 [pid 1508] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1506] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1494] <... ioctl resumed>) = 0 [pid 299] getdents64(3, [pid 1508] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1494] close(4 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 1508] <... open resumed>) = 4 [pid 1505] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1504] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1499] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 1498] <... futex resumed>) = 0 [pid 1497] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1494] <... close resumed>) = 0 [pid 299] close(3 [pid 1508] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1494] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 1508] <... futex resumed>) = 1 [pid 1504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1501] <... futex resumed>) = 0 [pid 1499] <... mprotect resumed>) = 0 [ 34.887586][ T1494] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.898178][ T1503] loop3: detected capacity change from 0 to 512 [ 34.904539][ T1494] ext4 filesystem being mounted at /root/syzkaller.qPQybd/40/file1 supports timestamps until 2038 (0x7fffffff) [pid 1498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1497] <... futex resumed>) = 0 [pid 1494] <... futex resumed>) = 0 [pid 299] rmdir("./42" [pid 1508] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1501] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1494] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... rmdir resumed>) = 0 [pid 1508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1501] <... futex resumed>) = 0 [pid 299] mkdir("./43", 0777 [pid 1508] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... mkdir resumed>) = 0 [pid 1508] <... mount resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1508] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 1508] <... futex resumed>) = 1 [pid 1501] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 1508] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1501] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 1508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1501] <... futex resumed>) = 0 [pid 299] close(3 [pid 1508] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1504] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1499] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1498] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1492] exit_group(0 [pid 299] <... close resumed>) = 0 [pid 1508] <... open resumed>) = 5 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1508] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1501] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 1511 [pid 1508] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1501] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1501] <... futex resumed>) = 0 [pid 1508] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1508] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1508] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1501] <... futex resumed>) = 0 [pid 1508] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1501] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1501] <... futex resumed>) = 0 [pid 1508] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1501] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1508] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1508] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1501] <... futex resumed>) = 0 [pid 1508] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1509] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 1509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1509] memfd_create("syzkaller", 0) = 3 [pid 1509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 1509] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1504] <... mount resumed>) = 0 [pid 1499] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1498] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1509] <... write resumed>) = 262144 [pid 1505] <... write resumed>) = 262144 [pid 1509] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 1506] <... write resumed>) = 262144 [pid 1505] munmap(0x7f0c41dcd000, 138412032 [pid 1504] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 1498] <... mprotect resumed>) = 0 [pid 1496] <... futex resumed>) = ? [pid 1494] <... futex resumed>) = ? [pid 1492] <... exit_group resumed>) = ? [pid 1509] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 1506] munmap(0x7f0c41dee000, 138412032 [pid 1505] <... munmap resumed>) = 0 [pid 1504] <... futex resumed>) = 1 [pid 1498] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1497] <... futex resumed>) = 0 [pid 1496] +++ exited with 0 +++ [pid 1494] +++ exited with 0 +++ [pid 1506] <... munmap resumed>) = 0 [pid 1505] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1504] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1499] <... clone3 resumed> => {parent_tid=[1512]}, 88) = 1512 [pid 1498] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1497] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1492] +++ exited with 0 +++ [pid 1506] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 1505] <... openat resumed>) = 6 [pid 1504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1499] rt_sigprocmask(SIG_SETMASK, [], [pid 1498] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1497] <... futex resumed>) = 0 [pid 1506] <... openat resumed>) = 4 [pid 1505] ioctl(6, LOOP_SET_FD, 3 [pid 1504] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1499] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1513 attached ./strace-static-x86_64: Process 1512 attached ./strace-static-x86_64: Process 1511 attached [pid 1509] <... openat resumed>) = 4 [pid 1506] ioctl(4, LOOP_SET_FD, 3 [pid 1503] <... mount resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1492, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 1513] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1512] set_robust_list(0x7f0c41ded9a0, 24 [pid 1511] set_robust_list(0x555556d8d6a0, 24 [ 34.949050][ T1503] EXT4-fs (loop3): 1 orphan inode deleted [ 34.954969][ T1503] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 34.973018][ T1503] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/40/file1 supports timestamps until 2038 (0x7fffffff) [ 34.977421][ T1505] loop2: detected capacity change from 0 to 512 [ 34.991172][ T1506] loop1: detected capacity change from 0 to 512 [ 34.991687][ T1509] loop0: detected capacity change from 0 to 512 [pid 1509] ioctl(4, LOOP_SET_FD, 3 [pid 1503] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 1513] <... set_robust_list resumed>) = 0 [pid 1512] <... set_robust_list resumed>) = 0 [pid 1511] <... set_robust_list resumed>) = 0 [pid 1506] <... ioctl resumed>) = 0 [pid 1505] <... ioctl resumed>) = 0 [pid 1504] <... open resumed>) = 5 [pid 1499] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] <... clone3 resumed> => {parent_tid=[1513]}, 88) = 1513 [pid 1506] close(3 [pid 1505] close(3 [pid 1504] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] <... futex resumed>) = 0 [pid 1498] rt_sigprocmask(SIG_SETMASK, [], [pid 1506] <... close resumed>) = 0 [pid 1505] <... close resumed>) = 0 [pid 1504] <... futex resumed>) = 1 [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1497] <... futex resumed>) = 0 [pid 1506] mkdir("./file1", 0777 [pid 1505] mkdir("./bus", 0777 [pid 1504] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1498] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1497] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1506] <... mkdir resumed>) = 0 [pid 1505] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1498] <... futex resumed>) = 0 [pid 1497] <... futex resumed>) = 0 [pid 1506] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1505] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1504] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1513] rt_sigprocmask(SIG_SETMASK, [], [pid 1512] rt_sigprocmask(SIG_SETMASK, [], [pid 1511] chdir("./43" [pid 1509] <... ioctl resumed>) = 0 [pid 1504] <... write resumed>) = 8 [pid 1503] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1504] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1513] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1512] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1511] <... chdir resumed>) = 0 [pid 1504] <... futex resumed>) = 1 [pid 1503] ioctl(4, LOOP_CLR_FD [pid 1497] <... futex resumed>) = 0 [pid 1509] close(3 [pid 1504] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1497] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1497] <... futex resumed>) = 0 [pid 1504] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1497] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1512] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1504] <... write resumed>) = 1045 [pid 1503] <... ioctl resumed>) = 0 [pid 1513] <... open resumed>) = 5 [pid 1504] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1497] <... futex resumed>) = 0 [pid 1504] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1512] <... open resumed>) = 3 [pid 1513] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1512] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1511] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1503] close(4 [pid 298] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 1513] <... futex resumed>) = 1 [pid 1512] <... futex resumed>) = 1 [pid 1511] <... prctl resumed>) = 0 [pid 1509] <... close resumed>) = 0 [pid 1503] <... close resumed>) = 0 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1499] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1513] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 1512] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 1511] setpgid(0, 0 [pid 1509] mkdir("./bus", 0777 [pid 1503] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 1513] <... mount resumed>) = 0 [pid 1512] <... mount resumed>) = 0 [pid 1511] <... setpgid resumed>) = 0 [pid 1511] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1503] <... futex resumed>) = 0 [pid 1497] exit_group(0 [pid 298] newfstatat(3, "", [pid 1513] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1512] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1511] <... openat resumed>) = 3 [pid 1503] close(1244505600 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1513] <... futex resumed>) = 1 [pid 1512] <... futex resumed>) = 1 [pid 1511] write(3, "1000", 4 [pid 1504] <... futex resumed>) = ? [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1497] <... exit_group resumed>) = ? [pid 1503] +++ exited with 0 +++ [pid 1513] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1512] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] <... write resumed>) = 4 [pid 1504] +++ exited with 0 +++ [pid 1499] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 1511] close(3) = 0 [pid 1511] symlink("/dev/binderfs", "./binderfs") = 0 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1497] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1513] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1511] <... futex resumed>) = 0 [pid 1511] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1511] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1511] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1511] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1511] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1511] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[1517]}, 88) = 1517 [pid 1511] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1511] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1511] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1511] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1511] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1511] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1497, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1513] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1512] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c./strace-static-x86_64: Process 1518 attached ./strace-static-x86_64: Process 1517 attached [pid 1513] <... open resumed>) = 3 [pid 1512] <... open resumed>) = 5 [pid 1509] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] <... umount2 resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 1518] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1517] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1513] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1512] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1509] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... restart_syscall resumed>) = 0 [pid 1518] <... set_robust_list resumed>) = 0 [pid 1517] <... set_robust_list resumed>) = 0 [pid 1513] <... futex resumed>) = 1 [pid 1512] <... futex resumed>) = 1 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1518] rt_sigprocmask(SIG_SETMASK, [], [pid 1517] rt_sigprocmask(SIG_SETMASK, [], [pid 1513] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1512] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1499] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./40/bus", [pid 1518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1513] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1517] memfd_create("syzkaller", 0 [pid 1513] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1512] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./40/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1517] <... memfd_create resumed>) = 3 [pid 298] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 1517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 1517] <... mmap resumed>) = 0x7f0c41dcd000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 1517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 1513] <... write resumed>) = 8 [pid 1512] <... write resumed>) = 8 [pid 1511] <... clone3 resumed> => {parent_tid=[1518]}, 88) = 1518 [pid 1513] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1512] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1511] rt_sigprocmask(SIG_SETMASK, [], [pid 1513] <... futex resumed>) = 1 [pid 1512] <... futex resumed>) = 1 [pid 1511] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1513] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1512] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1499] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1498] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = 0 [pid 1517] <... write resumed>) = 262144 [pid 1513] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] <... futex resumed>) = 1 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./40/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 1518] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1513] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1512] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1499] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1498] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1518] <... open resumed>) = 4 [pid 1513] <... write resumed>) = 1045 [pid 1512] <... write resumed>) = 1045 [pid 1518] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1513] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1512] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = 1 [pid 1513] <... futex resumed>) = 1 [pid 1512] <... futex resumed>) = 1 [pid 1511] <... futex resumed>) = 0 [pid 1499] <... futex resumed>) = 0 [pid 1498] <... futex resumed>) = 0 [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1513] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1512] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] <... futex resumed>) = 0 [pid 1518] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1518] <... mount resumed>) = 0 [pid 1517] munmap(0x7f0c41dcd000, 138412032 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 1518] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1517] <... munmap resumed>) = 0 [pid 298] unlink("./40/binderfs" [pid 1518] <... futex resumed>) = 1 [pid 1511] <... futex resumed>) = 0 [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] <... futex resumed>) = 0 [pid 1518] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1518] <... open resumed>) = 5 [pid 1518] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1511] <... futex resumed>) = 0 [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] <... futex resumed>) = 0 [pid 1518] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [ 35.020097][ T1505] EXT4-fs (loop2): 1 orphan inode deleted [ 35.026061][ T1506] EXT4-fs (loop1): 1 orphan inode deleted [ 35.032073][ T1505] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 35.035055][ T1506] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 35.044941][ T1505] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/41/bus supports timestamps until 2038 (0x7fffffff) [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1518] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1518] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1511] <... futex resumed>) = 0 [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1511] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1511] <... futex resumed>) = 0 [pid 1518] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1511] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1518] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1518] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1511] <... futex resumed>) = 0 [pid 1518] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1517] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 1506] <... mount resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 1517] <... openat resumed>) = 6 [pid 1506] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 298] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1517] ioctl(6, LOOP_SET_FD, 3 [pid 1506] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 1517] <... ioctl resumed>) = 0 [pid 1506] ioctl(4, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = 0 [pid 1517] close(3 [pid 1506] <... ioctl resumed>) = 0 [pid 297] umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1517] <... close resumed>) = 0 [pid 1506] close(4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 1517] mkdir("./bus", 0777 [pid 1506] <... close resumed>) = 0 [pid 1517] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 1506] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1517] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 1506] <... futex resumed>) = 0 [pid 1506] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] newfstatat(AT_FDCWD, "./40/bus", [pid 1499] exit_group(0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 1512] <... futex resumed>) = ? [pid 1506] <... futex resumed>) = ? [pid 1505] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 1499] <... exit_group resumed>) = ? [pid 297] unlink("./40/bus") = 0 [pid 297] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./40/binderfs") = 0 [pid 297] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1506] +++ exited with 0 +++ [pid 1505] ioctl(6, LOOP_CLR_FD [pid 1512] +++ exited with 0 +++ [pid 1505] <... ioctl resumed>) = 0 [pid 1499] +++ exited with 0 +++ [pid 1505] close(6 [pid 1509] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 1509] ioctl(4, LOOP_CLR_FD) = 0 [ 35.065971][ T1506] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/39/file1 supports timestamps until 2038 (0x7fffffff) [ 35.072382][ T1509] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 35.079347][ T1517] loop5: detected capacity change from 0 to 512 [ 35.099078][ T1509] EXT4-fs (loop0): get root inode failed [ 35.105826][ T1509] EXT4-fs (loop0): mount failed [pid 1509] close(4) = 0 [pid 1505] <... close resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1499, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 1509] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1505] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1501] exit_group(0 [pid 295] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1509] <... futex resumed>) = 0 [pid 1509] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1505] <... futex resumed>) = 0 [pid 1505] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 1501] <... exit_group resumed>) = ? [pid 1505] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 1498] exit_group(0 [pid 1509] <... futex resumed>) = ? [pid 1498] <... exit_group resumed>) = ? [pid 1509] +++ exited with 0 +++ [pid 1508] <... futex resumed>) = ? [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./39/bus", [pid 1513] <... futex resumed>) = ? [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./39/bus") = 0 [pid 298] <... umount2 resumed>) = 0 [pid 295] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./39/binderfs") = 0 [pid 295] umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 1508] +++ exited with 0 +++ [pid 1501] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] newfstatat(AT_FDCWD, "./40/file1", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(AT_FDCWD, "./40/file1", [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1501, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... restart_syscall resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 297] openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(4, "", [pid 297] <... openat resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] newfstatat(4, "", [pid 296] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, [pid 296] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] getdents64(4, [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] getdents64(4, [pid 296] newfstatat(3, "", [pid 298] close(4 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... close resumed>) = 0 [pid 297] close(4 [pid 296] getdents64(3, [pid 298] rmdir("./40/file1" [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... rmdir resumed>) = 0 [pid 297] rmdir("./40/file1" [pid 296] umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 297] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] close(3 [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./41/bus", [pid 297] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] rmdir("./40" [pid 298] rmdir("./40" [pid 296] unlink("./41/bus" [pid 297] <... rmdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] mkdir("./41", 0777 [pid 296] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] mkdir("./41", 0777 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... mkdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./41/binderfs", [pid 298] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] unlink("./41/binderfs" [pid 297] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 296] <... unlink resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] getdents64(3, [pid 298] close(3 [pid 297] close(3 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1517] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./41"./strace-static-x86_64: Process 1525 attached [pid 1517] ioctl(6, LOOP_CLR_FD [pid 296] <... rmdir resumed>) = 0 [pid 1525] set_robust_list(0x555556d8d6a0, 24 [pid 1517] <... ioctl resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 1524 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 1525 [pid 296] mkdir("./42", 0777 [pid 1525] <... set_robust_list resumed>) = 0 [pid 1517] close(6 [pid 296] <... mkdir resumed>) = 0 [pid 1517] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 1517] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 1517] <... futex resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 1517] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 1525] chdir("./41" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 1525] <... chdir resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 1526 [pid 1525] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 1526 attached [pid 1511] exit_group(0 [pid 1525] <... prctl resumed>) = 0 [pid 1518] <... futex resumed>) = ? [pid 1517] <... futex resumed>) = ? [pid 1511] <... exit_group resumed>) = ? [pid 1518] +++ exited with 0 +++ ./strace-static-x86_64: Process 1524 attached [pid 1524] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 1524] chdir("./41") = 0 [pid 1524] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 1525] setpgid(0, 0 [pid 1524] setpgid(0, 0) = 0 [pid 1524] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1525] <... setpgid resumed>) = 0 [pid 1526] set_robust_list(0x555556d8d6a0, 24 [pid 1525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 1526] <... set_robust_list resumed>) = 0 [pid 1524] <... openat resumed>) = 3 [pid 1525] write(3, "1000", 4 [pid 1524] write(3, "1000", 4) = 4 [pid 1525] <... write resumed>) = 4 [pid 1525] close(3) = 0 [pid 1525] symlink("/dev/binderfs", "./binderfs" [pid 1524] close(3) = 0 [pid 1524] symlink("/dev/binderfs", "./binderfs" [pid 1525] <... symlink resumed>) = 0 [pid 1525] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1524] <... symlink resumed>) = 0 [pid 1525] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 1524] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1524] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1525] <... rt_sigaction resumed>NULL, 8) = 0 [pid 1525] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1524] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1525] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 1526] chdir("./42" [pid 1525] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1524] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1524] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 1525] <... mprotect resumed>) = 0 [pid 1524] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1525] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1524] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1525] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1524] <... clone3 resumed> => {parent_tid=[1528]}, 88) = 1528 [pid 1525] <... clone3 resumed> => {parent_tid=[1527]}, 88) = 1527 [pid 1525] rt_sigprocmask(SIG_SETMASK, [], [pid 1524] rt_sigprocmask(SIG_SETMASK, [], [pid 1525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1525] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1524] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1526] <... chdir resumed>) = 0 [pid 1525] <... futex resumed>) = 0 [pid 1524] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1524] <... futex resumed>) = 0 [pid 1526] <... prctl resumed>) = 0 [pid 1525] <... futex resumed>) = 0 [pid 1524] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1526] setpgid(0, 0 [pid 1525] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1524] <... futex resumed>) = 0 [pid 1525] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1526] <... setpgid resumed>) = 0 [pid 1525] <... mprotect resumed>) = 0 [pid 1526] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 1525] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 1525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1524] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 1524] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1526] <... openat resumed>) = 3 [pid 1525] <... clone3 resumed> => {parent_tid=[1529]}, 88) = 1529 [pid 1524] <... mprotect resumed>) = 0 [pid 1526] write(3, "1000", 4 [pid 1525] rt_sigprocmask(SIG_SETMASK, [], [pid 1524] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 1529 attached ./strace-static-x86_64: Process 1528 attached ./strace-static-x86_64: Process 1527 attached [pid 1526] <... write resumed>) = 4 [pid 1525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1524] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1526] close(3 [pid 1525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1524] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1526] <... close resumed>) = 0 [pid 1525] <... futex resumed>) = 0 [pid 1526] symlink("/dev/binderfs", "./binderfs" [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1524] <... clone3 resumed> => {parent_tid=[1530]}, 88) = 1530 [pid 1524] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1524] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] <... symlink resumed>) = 0 [pid 1524] <... futex resumed>) = 0 [pid 1524] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 1530 attached [pid 1530] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 1529] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 1528] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1527] set_robust_list(0x7f0c4a20e9a0, 24 [pid 1526] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1530] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1526] <... futex resumed>) = 0 [pid 1526] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 1526] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 1530] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1529] <... set_robust_list resumed>) = 0 [pid 1526] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 1529] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 1528] <... set_robust_list resumed>) = 0 [pid 1527] <... set_robust_list resumed>) = 0 [pid 1526] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 1529] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 1526] <... mprotect resumed>) = 0 [pid 1530] <... open resumed>) = 3 [pid 1526] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1530] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1524] <... futex resumed>) = 0 [pid 1526] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1524] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 1529] <... open resumed>) = 3 [pid 1524] <... futex resumed>) = 0 [pid 1524] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1529] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 1527] rt_sigprocmask(SIG_SETMASK, [], [pid 1526] <... clone3 resumed> => {parent_tid=[1531]}, 88) = 1531 [pid 1525] <... futex resumed>) = 0 [pid 1529] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1526] rt_sigprocmask(SIG_SETMASK, [], [pid 1525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1527] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1529] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1525] <... futex resumed>) = 0 [pid 1529] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 1527] memfd_create("syzkaller", 0 [pid 1526] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1526] <... futex resumed>) = 0 [pid 1529] <... mount resumed>) = 0 [pid 1526] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 1529] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 1525] <... futex resumed>) = 0 [pid 1529] <... futex resumed>) = 1 [pid 1527] <... memfd_create resumed>) = 4 [pid 1526] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 1525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1529] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1527] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 1526] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 1525] <... futex resumed>) = 0 [pid 1529] <... open resumed>) = 5 [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1529] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1527] <... mmap resumed>) = 0x7f0c41dcd000 [pid 1526] <... mprotect resumed>) = 0 [pid 1525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 1525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] rt_sigprocmask(SIG_BLOCK, ~[], [pid 1525] <... futex resumed>) = 0 [pid 1529] <... futex resumed>) = 0 [pid 1526] <... rt_sigprocmask resumed>[], 8) = 0 [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1529] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 1526] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 1530] <... futex resumed>) = 1 [pid 1530] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 1529] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1530] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1529] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1526] <... clone3 resumed> => {parent_tid=[1532]}, 88) = 1532 [pid 1526] rt_sigprocmask(SIG_SETMASK, [], [pid 1525] <... futex resumed>) = 0 [pid 1526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 1529] <... futex resumed>) = 1 [pid 1526] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1529] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 1526] <... futex resumed>) = 0 [pid 1525] <... futex resumed>) = 0 [pid 1526] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1529] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 1530] <... futex resumed>) = 1 [pid 1529] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1524] <... futex resumed>) = 0 [pid 1530] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 1524] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 1530] <... open resumed>) = 4 [pid 1529] <... futex resumed>) = 1 [pid 1525] <... futex resumed>) = 0 [pid 1524] <... futex resumed>) = 0 [pid 1530] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 1529] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 1524] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 1530] <... futex resumed>) = 0 [pid 1528] rt_sigprocmask(SIG_SETMASK, [], [pid 1524] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable)